fix(vm): scope GPU filesystem enrichment to assigned workloads

[drew]

Summary

CPU-only microVMs on NVIDIA GPU hosts failed before workload launch when their policy kept /proc read-only: the host supervisor discovered its own GPU devices, promoted /proc to read-write, and attempted an invalid live-policy update. Remove supervisor-side GPU discovery and let the sandbox apply GPU allowances from its immutable assignment claim and guest-visible devices.

Related Issue

Closes #3579. Implementation directly requested by the maintainer; issue lifecycle labels were left unchanged.

Changes

• Keep supervisor enrichment limited to proxy baseline paths and preserve explicit read-only entries, including /proc.
• Carry the existing openshell.gpu claim in both sides of VM boundary provisioning when the VM requests a GPU, retaining workload-local GPU enrichment.
• Replace host-dependent supervisor GPU tests with policy-preservation regressions and cover VM provisioning with and without a GPU claim.
• Clarify the boundary in architecture, compute-driver docs, and troubleshooting guidance. Gateway live-policy validation is unchanged.

Testing

• mise run pre-commit passed, including the commit hook.
• mise run test passed (workspace Rust, server tests with test-support, Python, TypeScript, and repository tooling tests).
• mise run ci was attempted; Go gateway-discovery tests failed because /etc/openshell/gateways/default on this host is included alongside their fixtures (TestListGateways_MultipleGateways, TestListGateways_EmptyDirs, TestListGateways_ActiveStatus). No Go code changed.
• Supervisor baseline tests: 9 passed.
• VM boundary provisioning tests: 2 passed, including both CPU and GPU claim cases.
• Rebuilt embedded guest/supervisor artifacts with mise run vm:supervisor, then ran mise run gateway:vm on the ARM64 NVIDIA host. A CPU-only sandbox launched with the original policy; effective /proc remained read-only, UID/GID were 1000, capability sets were zero, NoNewPrivs=1 and seccomp=2, and workspace read/write/delete passed. Temporary sandbox and gateway state were removed.
• mise run e2e passed: Rust Docker e2e and CLI conformance, Python (60 passed / 81 skipped), and MCP conformance.
• GPU passthrough/CUDA was not exercised. This verifies the startup regression, not the full sandbox boundary qualification matrix.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture and relevant user/operator docs updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3580.docs.buildwithfern.com/openshell

[elezar]

The supervisor/workload ownership boundary is now clear, and the requested proxy-baseline cleanup is addressed. The CPU-only VM regression fix and VM GPU claim propagation look correct. Workload-side GPU enrichment coverage and explicit supplementary-group authorization can follow with the CDI stack rooted at #2775.