fix(supervisor-network): distinguish absent policy binary from filesystem-access failure

[letv1nnn]

Summary

resolve_binary_in_container reported an absent non-glob policy binary candidate (ENOENT) with the same WARN as a genuine failure to access /proc/<pid>/root, wrongly telling operators to add CAP_SYS_PTRACE or canonicalize paths. Built-in profiles like pypi list multiple candidate layouts, so images using one layout emitted a burst of misleading warnings on every policy rebuild. This change classifies resolution outcomes into a typed result and logs absent candidates quietly while keeping genuine access failures actionable.

Related Issue

Closes#2883

Changes

• Replace resolve_binary_in_container's Option<String> return with a typed BinaryResolution enum (Resolved, Literal, Absent, Inaccessible, ChainBroken); the resolver no longer logs.
• Move all logging to the caller (proto_to_opa_data_json): Resolved → info, Absent → debug, Inaccessible/ChainBroken → warn. Fixes a pre-existing double-log and a mislabeled broken-chain path.
• Probe /proc/<pid>/root reachability up front: an unreachable process root (pid gone → ENOENT, or denied → EACCES) is classified Inaccessible, while a leaf ENOENT under a reachable root is Absent — resolving the errno ambiguity.
• Always retain the original literal binary path; existing symlinks still contribute their canonical targets.
• Add tests: errno classification (NotFound/PermissionDenied), absent candidate → Absent, unreachable root → Inaccessible, and a caller-level test asserting absent candidates emit zero WARN events. Update existing resolver tests to the enum.

Testing

Since I'm on macOS, I ran the Linux-only tests in a rust:latest Docker container to make sure the #[cfg(target_os = "linux")] paths actually pass.

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.