refactor(core): use upstream CDI name validation

[elezar]

Summary

Use the public upstream CDI predicate on Linux for the name validation introduced in #4306, retaining the existing local checker on other platforms. This moves reusable CDI dependency and vendoring setup out of the resolver work in #4204 without changing accepted selectors or validation errors.

Related Issue

No issue required: internal refactor of the existing validation added in #4306, with no user-facing behavior change.

Follow-up to #4306 (fix(drivers): validate vendor-agnostic CDI device names); prerequisite for #4204. Includes the Git vendoring support from #4204 commit 4cad83e.

Changes

• Expose one cdi_name::is_qualified_name entrypoint: directly reexport upstream on Linux and select the unchanged local checker elsewhere. Reuse the existing GPU validation tests.
• Pin the revision exposing the public predicate from container-device-interface-rs #177, with default features disabled. Add the dependency only for Linux and refresh the affected lockfiles and Git source allowlist.
• Preserve Cargo's complete source mapping in Packit vendor archives and RPM preparation, including the pinned Git source. Capture cargo vendor output without --quiet, which suppresses the mapping on the current toolchain.

Testing

• mise run pre-commit passes.
• Existing focused core CDI/GPU validation tests pass on macOS.
• Linux module reexport and pinned upstream dependency type-check for aarch64-unknown-linux-gnu in a minimal check harness.
• Dependency source/license checks and tracked lockfile validation pass.
• Corrected CDI vendor fixture survives archive extraction and Linux checking with --locked --offline and empty registry/Git caches. Full-workspace offline dependency resolution also passes with the complete vendor tree and corrected mappings.
• mise run ci: stops at the unchanged openshell-supervisor-network test mediated_connect_keeps_workload_bytes_read_with_the_synthesized_header with an upstream-request timeout. An isolated retry of the same workspace test binary passes.
• Full Fedora RPM build and native Linux execution: not run locally.

Checklist

• Follows Conventional Commits.
• Commit signed off for DCO.
• No user-facing documentation changes required.

[github-actions]

Label test:e2e applied for 360f6d5. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e-gpu applied for 360f6d5. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.