refactor: modularize audit and harden build validation

audit/internal/platform/nvidia_bandwidth_socket.go

@@ -11,12 +11,8 @@ import (
 // satReadFile is a seam for tests to fake sysfs reads (numa_node files).
 var satReadFile = os.ReadFile
 
-// gpuBandwidthSocketGroups splits gpuIndices into per-socket groups (ordered
-// by ascending NUMA node ID) for RunNvidiaBandwidthPack. A cross-socket
-// peer-to-peer path is a different (and, on platforms without NVLink, far
-// less exercised) fault domain than a same-socket one, so testing each
-// socket's GPUs in isolation before testing all of them together isolates
-// whether a failure is specific to the cross-socket path.
+// gpuBandwidthSocketGroups splits gpuIndices into NUMA-locality groups,
+// ordered by ascending Linux NUMA node ID, for RunNvidiaBandwidthPack.
 //
 // Falls back to a single group containing all of gpuIndices — i.e. no split
 // — whenever the NUMA node can't be resolved for every GPU, or all resolve
@@ -31,22 +27,17 @@ func gpuBandwidthSocketGroups(gpuIndices []int, logFunc func(string)) [][]int {
 	}
 
 	byNode := map[int][]int{}
-	var unresolved []int
 	for _, idx := range gpuIndices {
 		node, ok := nodes[idx]
 		if !ok {
 			if logFunc != nil {
-				logFunc(fmt.Sprintf("nvbandwidth: no NUMA node resolved for GPU %d; will fold it into a resolved socket group instead of dropping the split", idx))
+				logFunc(fmt.Sprintf("nvbandwidth: no NUMA node resolved for GPU %d; running all GPUs as one group", idx))
 			}
-			unresolved = append(unresolved, idx)
-			continue
+			return [][]int{gpuIndices}
 		}
 		byNode[node] = append(byNode[node], idx)
 	}
-	// Fewer than two resolved sockets means there's nothing to split either
-	// way: every GPU's node is unknown, or every resolved GPU shares one
-	// socket. A single unresolved GPU among an otherwise clean multi-socket
-	// system shouldn't cost us the split, so only bail out here.
+	// Fewer than two NUMA nodes means there is nothing meaningful to split.
 	if len(byNode) < 2 {
 		return [][]int{gpuIndices}
 	}
@@ -61,14 +52,6 @@ func gpuBandwidthSocketGroups(gpuIndices []int, logFunc func(string)) [][]int {
 	for _, node := range sortedNodes {
 		groups = append(groups, dedupeSortedIndices(byNode[node]))
 	}
-	if len(unresolved) > 0 {
-		// Fold into the last group rather than running unresolved GPUs in a
-		// group of their own — a lone GPU can't run a GPU-to-GPU bandwidth
-		// test by itself, and the point of the split is to isolate the
-		// sockets we *do* know about, not to also isolate the unknown one.
-		last := len(groups) - 1
-		groups[last] = dedupeSortedIndices(append(groups[last], unresolved...))
-	}
 	return groups
 }
 
@@ -107,10 +90,16 @@ func gpuNUMANodes(gpuIndices []int) (map[int]int, error) {
 	return nodes, nil
 }
 
-// normalizeNvidiaBDF converts nvidia-smi's 8-hex-digit-domain PCI bus ID
-// ("00000000:05:00.0") to the 4-hex-digit-domain form sysfs paths use
-// ("0000:05:00.0").
+// normalizeNvidiaBDF converts nvidia-smi's PCI bus ID to the exact form the
+// sysfs paths under /sys/bus/pci/devices use: an 8-hex-digit domain is
+// narrowed to 4 digits ("00000000:05:00.0" -> "0000:05:00.0"), and the hex
+// is lower-cased ("0000:CB:00.0" -> "0000:cb:00.0"). nvidia-smi upper-cases
+// the bus/device hex; sysfs directory names are always lower-case, so
+// without this a BDF containing a hex letter (e.g. GPUs on bus 4b/cb/cf)
+// would never match a sysfs entry and every numa_node / link-speed read
+// would silently fail.
 func normalizeNvidiaBDF(busID string) string {
+	busID = strings.ToLower(strings.TrimSpace(busID))
 	domain, rest, ok := strings.Cut(busID, ":")
 	if !ok {
 		return busID