fix(cli): preserve Linux venv lib64 aliases

[afourniernv]

Overview

Linux virtual environments normally contain a root lib64 -> lib symlink. Dynamic Python plugin attestation currently traverses that alias as a second copy and can reject a physically sub-512 MiB environment as oversized. Activation snapshots also expand the alias instead of preserving it.

• I confirm this contribution is my own work, or I have the right to submit it under this project license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Charge file bytes once for the exact top-level lib64 -> lib venv alias while continuing to hash both logical paths.
• Keep all entry/depth limits and normal byte charging for every other symlink.
• Preserve the standard alias in Unix activation snapshots when pyvenv.cfg identifies the venv root.
• Add regression coverage for budget enforcement, digest compatibility, snapshot verification, and tamper detection.

Where should the reviewer start?

Start with python_environment_byte_budget_counts_internal_directory_alias_once and python_activation_snapshot_preserves_internal_directory_alias in crates/cli/tests/coverage/shared/plugins_lifecycle_tests.rs.

Validation:

• 92 plugin lifecycle tests passed
• cargo clippy -p nemo-relay-cli --all-targets -- -D warnings
• cargo fmt --all -- --check

Related Issues

• Relates to NVIDIA/NeMo-Relay-Plugins#6

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[afourniernv]

/nvskills-ci