Reconcile NVIDIA state on every nspawn machine start

[Copilot]

NVIDIA driver roots and CDI specifications could remain stale after host reboots or direct nspawn restarts, allowing containerd and kubelet to start before GPU runtime state was rebuilt.

• Lifecycle reconciliation

  • Add an nspawn ExecStartPost hook for NVIDIA machines.
  • Reload the persisted machine configuration and reuse the existing idempotent SetupNVIDIA task.
  • Wait for machine D-Bus readiness before reconciliation.

• Service readiness

  • Gate containerd and kubelet on unbounded-nvidia-ready.service.
  • Release the gate only after driver-root preparation and CDI generation succeed.
  • Keep initial bootstrap and repave on the existing managed setup path.

• Failure handling

  • Propagate reconciliation failures to the nspawn unit so systemd retries the machine.
  • Leave non-NVIDIA machines unchanged.

• Fixes Reconcile NVIDIA driver root and CDI state on every nspawn machine start #588