build: AUT-1619 install NCCL gIB plugin in CI image

[svcnemo-autobot]

Background

The release CI image needs Google Cloud’s NCCL gIB plugin without executing unauditable package hooks or unsupported private-registry build stages.

What changed

Downloads the exact content layer from Google’s official NCCL gIB image, verifies layer SHA-256 5571c2a0…74770, and inertly extracts only configs, lib64, and scripts. It then registers the gIB library directory. No package manager, maintainer script, or archive executable runs.

Details

flowchart LR
  A[Pinned Google layer] --> B[Verify SHA-256]
  B --> C[Extract allowlisted paths]
  C --> D[Register library path]

Loading

Tested

• Verified layer checksum and 27 selected entries
• Verified required network, environment, profiler, tuner, config, and setup files
• Exercised the exact extraction into an isolated root
• Confirmed apt/deb installation paths are absent
• Exact-head validation passed admission/security stages; image build is running

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.