bug: CPU-only microVM startup inherits host GPU filesystem requirements #3579

User Story

As a developer running CPU-only microVM sandboxes on a GPU host, I want a sandbox with read-only /proc to start without inheriting the host's GPU filesystem requirements.

Problem Statement

The VM supervisor runs on the host. Its baseline policy enrichment detects host NVIDIA devices and promotes /proc from read-only to read-write even when the VM requested no GPU. The gateway correctly rejects removal of the existing read-only entry during live policy synchronization, and sandbox startup fails before the workload launches.

Impact / Why This Matters

CPU-only VM workloads fail on GPU-equipped development hosts with an otherwise valid policy. Changing the authored policy to allow writes to /proc would avoid this particular validation error but unnecessarily changes workload permissions. GPU enrichment already exists inside the sandbox and should use the workload's assigned resources.

Acceptance Criteria

• A CPU-only microVM with read-only /proc starts on an NVIDIA GPU host using mise run gateway:vm.
• Supervisor baseline enrichment preserves read-only /proc and does not discover GPU devices on the host.
• GPU-assigned VMs carry the existing GPU resource claim so guest-local enrichment remains available.
• Regression tests cover CPU-only policy preservation and GPU resource-claim provisioning without requiring GPU hardware.
• Gateway live filesystem validation remains unchanged.

Reproduction Steps

1. Check out b671171091c32d12113f97945b6ef505eabaa7c6 on a Linux NVIDIA GPU host with KVM.
2. Build runtime artifacts with mise run vm:supervisor and start an isolated local gateway with mise run gateway:vm.
3. Create a CPU-only sandbox using the Ubuntu base image, no providers, no allowed network destinations, UID/GID 1000, required Landlock, and /proc in filesystem_policy.read_only.
4. Observe startup fail before /bin/sleep launches, after the supervisor attempts GPU-related policy enrichment.

Environment

• Source version: 0.0.117-dev.248+gb67117109; also observed with published dev .247.
• Host: Linux aarch64, kernel 6.17.0-1029-nvidia, NVIDIA device nodes present.
• Runtime: libkrun microVM, 2 vCPUs, 2048 MiB RAM, no GPU requested.
• Image: nvcr.io/nvidia/base/ubuntu@sha256:55c71972b75b5fb9c9bbf5baf0f74d97223a1544d935769e0a8e537065479bbe.

Logs

Promoting /proc from read-only to read-write for GPU runtime compatibility
filesystem read_only path '/proc' cannot be removed on a live sandbox