feat(gpu): derive sandbox requirements from CDI specs

[elezar]

Summary

Derive sandbox filesystem and process requirements from resolved CDI GPU specs so Docker GPU sandboxes can carry the effective device, mount, and group policy into the supervisor.

Related Issue

Related: #1606

Changes

• Add shared CDI context and resolver helpers for policy-relevant device nodes, mounts, and additional GIDs.
• Upload Docker CDI context/spec mounts when GPU CDI devices are selected.
• Enrich sandbox policies with CDI-derived paths and supplemental process groups.
• Apply CDI-derived additional GIDs before dropping supervisor privileges.
• Add architecture and user-facing documentation for CDI-derived GPU sandbox policy behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2265.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e-gpu applied for 5cd240a. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e applied for 5cd240a. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.