test(tmachine): add Docker CDI injection coverage and local DEB builds

[elezar]

Summary

Add hardware-free Docker CDI injection coverage to tmachine and build local Debian artifacts for package-installed qualification. The Docker environment recreates dummy YAML CDI specs on each boot, and the feature suite checks environment and mount injection through the installed OpenShell CLI.

Related Issue

Related to #4460. This PR supplies the initial CDI test infrastructure; the issue remains open to track follow-up coverage.

Changes

• Build the CLI, gateway, prover, VM init, and VM driver with its embedded Linux runtime in build-artifacts-binaries; package staged inputs with build-artifacts-deb and include both steps in build-artifacts.
• Refresh the verified Linux VM runtime archive checksums.
• Generate two fake NVIDIA CDI devices plus an unrelated vendor spec, using file mounts and TMACHINE_CDI_* environment markers. No GPU hardware or device nodes are required.
• Add eight tests for explicit/default/count selection, absence of injection without a GPU request, and invalid requests. Keep the existing reserved OPENSHELL_* environment behavior unchanged.
• Publish installed-gateway test context and temporarily enable caller device selection in a qualification TOML, restoring it after the tests. Retain the package-owned service and client authentication.
• Add Docker CDI coverage to branch and release feature-test matrices and document local commands.

Testing

• Checks appropriate to the affected code and behavior pass: Nix formatting/parsing, CDI Clippy and Rust formatting, Ansible syntax, and both commits' repository pre-commit hooks.
• Eight integration tests added; all eight passed with nix run .#tmachine -- test ubuntu-docker-rootful deb cdi on local ARM64 using freshly built DEB and matching runtime images.
• Separate build-artifacts-binaries and build-artifacts-deb commands passed; DEB packaging ran without invoking Cargo. Package architecture, version, and payload inspected.
• test-packaging-assets.sh passed with Debian tooling available.

Local executable validation was ARM64; the x86_64 builder was evaluated but not executed locally. Real GPU execution, device nodes, Podman, and Kubernetes CDI coverage are outside this change.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Testing documentation updated; runtime architecture is unchanged

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4461.docs.buildwithfern.com/openshell