fix(sandbox): decouple GPU baseline from network policy

[elezar]

Summary

Decouple sandbox baseline filesystem enrichment from the presence of network policies. This fixes a regression introduced by #158, where baseline enrichment became gated on network_policies and therefore skipped GPU path enrichment for default no-network sandboxes.

Related Issue

Refs #1486

Regression introduced by #158.
Stacked under #1522.

Changes

• Split baseline enrichment path collection from network-policy enrichment.
• Include GPU baseline and discovered GPU device paths even when no network policy is configured.
• Add regression coverage for GPU enrichment in the default no-network policy path.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)