recovery: align xpu-smi use in reset and reflash Jobs

[tkatila]

Don't assume xpu-smi's location in the image and use shell to find it. Also fixes invalid xpu-smi call in the reflash container.

[Copilot]

🟢 Approval recommended

The changes consistently align reset/reflash Job execution with sh -c semantics, add input allow-listing where needed, and include targeted test coverage for the new contract.

Pull request overview

This PR updates GPU recovery Jobs to invoke xpu-smi via /bin/sh -c so the operator does not assume a fixed install path for xpu-smi inside the referenced image, and corrects the reflash Job invocation semantics for sh -c.

Changes:

• Switch reset Job execution to /bin/sh -c and pass a single command-line string so xpu-smi is resolved on PATH.
• Fix reflash Job invocation so sh -c receives one command string (avoiding the prior argv/positional-parameter pitfall).
• Add strict BDF shape validation to prevent interpolating untrusted device identifiers into a privileged shell command line, with accompanying tests and docs.

File summaries

File	Description
RECOVERY.md	Documents the /bin/sh -c contract and PATH requirement for xpu-smi images.
internal/controller/gpurecoveryplan_helpers.go	Introduces BDF allow-list validation and switches reset/reflash command builders to return shell command strings.
internal/controller/gpurecoveryplan_controller.go	Enforces BDF validation during detection and updates reset/reflash Job arg injection to match sh -c semantics.
internal/controller/gpurecoveryplan_controller_test.go	Adds/updates tests for BDF validation and the one-arg sh -c “shell contract” for both Job templates.
config/deployments/xpum/xpum-reset-job.yaml	Updates the reset Job template to run /bin/sh -c with a single command-line argument.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.