Add repoConfig.nodeLocalPaths for node-local package repositories

[nikhaild]

Resolves #2884

Description

A package repository on the node's own disk cannot be used today: a "file:///opt/local-packages" URI supplied via driver.repoConfig does not resolve inside the driver container, and there is no supported way to expose the host directory to it.

Add an optional nodeLocalPaths list to the existing repoConfig API on both ClusterPolicy and NVIDIADriver. Each entry is bind-mounted read-only into the driver container at the same path, so file:// URIs resolve identically on the host and in the container. Paths are validated as clean, absolute and non-root, then deduplicated and sorted so volume naming is deterministic.

Defaults to empty, is ignored for precompiled drivers to match configMapName, and is rejected when set without a repo ConfigMap.

Example usage:

GPU Operator configuration snippet:

driver:
  repoConfig:
    configMapName: local-package-repo
    nodeLocalPaths:
      - /opt/local-packages

with Kubernetes configmap local-package-repo content as:

apiVersion: v1
kind: ConfigMap
metadata:
  name: local-package-repo
  namespace: gpu-operator
data:
  local-packages.sources: |
    Types: deb
    URIs: file:///opt/local-packages
    Suites: ./
    Signed-By: /opt/local-packages/keyring.gpg

The k8s node has the repo stored at node file system at /opt/local-packages (and has the deb packages for kernel-headers, other necessary packages needed by Nvidia driver container install script).

Checklist

• No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths

Testing

• New unit tests for the shared helper (validation, dedup, sort determinism, error cases).
• New unit tests in controllers/transforms_test.go and internal/state/ covering: mounts applied, multiple sorted paths, error when configMapName is empty, error on an invalid path, ignored for precompiled drivers, and no node-local-repo-* volume when the field is unset.
• Digest test asserting that changing a host path changes nvidia.com/driver-config-digest.
• Golden-file update for the rendered driver DaemonSet.
• Helm template assertions for both the ClusterPolicy and NVIDIADriver paths.
• New e2e case asserting the DaemonSet shape after patching the CR (does not require the driver to come up).
• Manually verified end-to-end on a cluster whose node image ships /opt/local-packages: the driver container resolves the local apt repository, installs, and nvidia-smi reports the GPUs.
• Live testing on a real k8s cluster - in-flight

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.