Resolve selected CDI edits in the workload namespace. Classify original mount destinations from effective access flags, inspect writable submounts, and require exact policy opt-in for writable regular files. Keep shared-library parents separate from original destinations.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
