fix(policy): support legitimate CDI policies above 256 paths

首先，使用基于 issue 非机密路径元数据的无硬件 fixture，复现 301-path NVIDIA Jetson AGX Thor CDI policy，然后研究安全的规范化，同时保留权限以及 mount/device 语义。添加对边界、重复项、冲突、超大输入和 fail-closed 行为的覆盖。完成要求包括一项有界的 policy 决策、文档，以及在 AGX Thor 和 IGX Orin 上成功进行 exact-build ARM64 NemoClaw 验证，同时覆盖所列的 restart、resume、rebuild 和 negative cases。

Problem

The native Docker CDI policy-enrichment path produced 301 filesystem paths for the NVIDIA Jetson AGX Thor qualification device, exceeding OpenShell's current 256-path policy limit before NemoClaw onboarding could complete.

The validation stack was #1606 through #2775, #2776, #2265, and #2846. A local 512-path change allowed qualification to proceed, but a blind limit increase is not a reviewed production solution: OpenShell must preserve a bounded, fail-closed policy while supporting legitimate CDI specifications.

Expected behavior

A legitimate selected Jetson CDI device can enrich the effective sandbox policy without exceeding an implementation-only ceiling. Duplicate or structurally redundant paths are normalized where safe. Excessive, malformed, conflicting, or adversarial requirements still fail closed with a diagnostic that reports the observed count and supported bound without dumping sensitive host metadata.

Acceptance

• Reproduce the 301-path AGX Thor CDI policy using a hardware-free fixture shaped from non-secret path metadata.
• Determine whether safe normalization/deduplication reduces the effective set; preserve distinct permissions and mount/device semantics.
• Define and document a bounded capacity that covers supported CDI devices, or replace the fixed entry ceiling with a resource limit tied to the actual policy representation.
• Add boundary tests at the accepted maximum, one above it, duplicate paths, conflicting access modes, and maliciously large input.
• Keep non-GPU sandbox policy and resource use unchanged.
• On the exact released OpenShell build, run the official ARM64 NemoClaw image through full AGX Thor and IGX Orin onboarding with exit 0 and no qualification-only limit patch.
• Re-run restart, resume, rebuild, non-GPU negative, and invalid/missing CDI fail-closed cases.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the 301-path failure and local 512-path qualification change.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership and release-gated validation contract.