fix: match the root at a path component boundary when transforming paths

[vyncint]

Problem

pkg/nvcdi/transform/root decides whether a path is contained in the (from) root using a plain string prefix comparison:

if !strings.HasPrefix(path, t.root) {
	return path
}

return filepath.Join(t.targetRoot, strings.TrimPrefix(path, t.root))

A path that shares a textual prefix with the root but is not actually inside it therefore matches, and is rewritten into a corrupted path.

With root=/run/nvidia/driver and targetRoot=/host:

path	current	expected
/run/nvidia/driver/lib/libcuda.so	/host/lib/libcuda.so	/host/lib/libcuda.so
/run/nvidia/driver-backup/lib/libcuda.so	/host/-backup/lib/libcuda.so	unchanged
/run/nvidia/driverfoo	/host/foo	unchanged

The last two paths lie outside the root and must be left untouched.

Reachability

transformPath is shared by hostRootTransformer and containerRootTransformer, so both host and container paths are affected. The roots are user-supplied:

• nvidia-ctk cdi transform root --from <root> --to <target>
• the driver root transform applied during CDI spec generation (NewDriverTransformer, driven by --driver-root / --dev-root)

Fix

Require the prefix match to end at a path component boundary. Behaviour that was already correct is unchanged:

• a path equal to the root still maps to the target root
• a root with a trailing separator, including a root of /, still matches
• a path with no common prefix is still returned untouched

Testing

Added TestTransformPath covering the two boundary cases plus five cases for the existing behaviour. I verified that the two new cases fail without the fix and pass with it, and that the other five pass either way.

Locally, on a machine with no NVIDIA GPU:

• make test — pass (44 packages)
• golangci-lint run ./... — 0 issues
• golangci-lint fmt --diff ./... — clean
• go build ./... — pass

Coverage for pkg/nvcdi/transform/root: 89.9% -> 90.2%.

Out of scope

The same prefix-comparison pattern also appears in internal/lookup/root.RelativeToRoot, internal/discover/mounts.go, and pkg/nvcdi/driver-nvml.go. I have left those untouched to keep this change small and reviewable, but I am happy to follow up if you would like them addressed as well.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.