Port NVL-domain-aware policy support for GB300

[yunwei37]

Summary

• carry NCCL tuner v5 NVL-domain metadata into the eBPF policy context with an explicit size guard and validated topology bounds
• add and register a conservative NVL-domain-aware policy while preserving the NCCL default outside its supported inputs
• make the plugin build use the pinned bpftime/libbpf headers consistently on native and aarch64 toolchains
• add a topology-neutral NCCL arm runner with per-arm environment isolation and regression coverage

This is a narrowed, maintainable port of the core work from datacrunch-research#1. Experiment-specific logs, topology data, host identities, benchmark results, and the .agents corpus are intentionally excluded.

Validation

• make build
• CTest: 2/2 tests passed
• all 25 BPF policy objects compiled
• strict-verifier policy integration matrix
• native crash-isolation test
• NCCL net eBPF plugin build
• aarch64 ABI/object and C++ syntax cross-checks
• shellcheck, bash -n, and arm-isolation regression test
• policy-registration, scope, and sensitive-content audits

Hardware validation boundary

GB300/Grace-Blackwell runtime, NVL72 collectives, multi-host MPI, CUDA profiler, and GPU transport tests require the target hardware and are not asserted by this PR.