[johnahull]

Summary

• Make OpenShift MCO the owner of GIM host configuration and stop the node-labeller from mutating host modprobe files.
• Add narrowly scoped SCC bindings for GIM/VFIO operand service accounts.
• Gate VF passthrough readiness on the current device-plugin DaemonSet rollout and AMD Node allocatable resources, with status/resource watchers.
• Document the OpenShift and KubeVirt GIM/VFIO prerequisites.

Validation

• Focused controller, watcher, and node-labeller tests pass.
• Non-E2E Go tests, go vet ./..., manager build, Helm lint/render, and whitespace checks pass.
• Live OpenShift validation used the built operator image and confirmed DevicePluginPending when no amd.com/gpu resource was advertised.
• The existing KubeVirt VFIO smoke VM remains Running/Ready through the built-in amd.com/kvgpu path.

Scope and limitations

• This PR contains operator-only changes; the AMD device-plugin repository is unchanged.
• Full E2E tests remain environment-blocked by missing E2E_UBUNTU_BASE_IMAGE, GPU_OPERATOR_CHART, and the local test API endpoint.
• Markdown lint could not run because markdownlint-cli2 is not installed.

Draft PR for review of the GIM/VFIO operator path.

[johnahull]

Superseded by focused draft PRs #681 and #682.