fix: add /usr/bin symlinks for nvidia-ctk and nvidia-cdi-hook

The gpu-operator device plugin generates CDI specs with hooks pointing
to /usr/bin/nvidia-ctk and /usr/bin/nvidia-cdi-hook (hardcoded defaults
in NVIDIA/k8s-device-plugin and NVIDIA/nvidia-container-toolkit). Talos
extensions install these binaries under /usr/local/bin/, causing pods
requesting nvidia.com/gpu resource limits to fail.

Add symlinks from /usr/bin/nvidia-ctk and /usr/bin/nvidia-cdi-hook to
their /usr/local/bin/ counterparts, following the same pattern as the
existing /usr/bin/ldconfig symlink. This eliminates the need for users
to set NVIDIA_CDI_HOOK_PATH in the gpu-operator values.

Requires siderolabs/talos#13021 validator allowlist update.

Signed-off-by: David Orman <ormandj@corenode.com>

Author: ormandj

nvidia-gpu/nvidia-container-toolkit/nvidia-container-runtime/pkg.yaml

@@ -35,6 +35,10 @@ steps:
         cd container-toolkit
 
         find . -maxdepth 1 -type f -executable -exec cp {} /rootfs/usr/local/bin/ \;
+      - |
+        mkdir -p /rootfs/usr/bin
+        ln -s /usr/local/bin/nvidia-ctk /rootfs/usr/bin/nvidia-ctk
+        ln -s /usr/local/bin/nvidia-cdi-hook /rootfs/usr/bin/nvidia-cdi-hook
       - |
         mkdir -p /rootfs/etc/cri/conf.d
         cp /pkg/10-nvidia-container-runtime.part /rootfs/etc/cri/conf.d/10-nvidia-container-runtime.part