feat(nico): add STG02/03/04 storage-infra observability validations

[abegnoche]

Summary

Implements the remaining NICo-mappable storage-infra trio from M7 triage (#358 / #359 / #360), following the proven query-script → neutral-JSON → validation pattern used in PR #539. All three ship unreleased (released_tests.json untouched); exercise with ISVTEST_INCLUDE_UNRELEASED=1.

Issue	Test ID	Check	NICo source
#358 STG02-01	STG02-01	SkipSanitizationBreakfixCheck	machine.status + statusHistory (Maintenance lifecycle) + instanceId/tenantId
#359 STG03-01	STG03-01	StableStorageNodeIpCheck	machine.machineInterfaces[].ipAddresses (primary interface)
#360 STG04-01	STG04-01	OobFailureDetectionCheck	machine.health BMC probes (BmcSensor, …)

Changes

STG02-01 — break/fix skip-sanitization policy

• Extends query_sanitization.py with Maintenance lifecycle token and per-machine breakfix_skip_observed / tenancy_preserved / instance_bound fields.
• SkipSanitizationBreakfixCheck audits SEC21 tenant-transition gates and allows tenancy-preserving in_use → maintenance → in_use paths without an intervening Reset.

STG03-01 — stable admin IP observability

• query_stable_ips.py reads machineInterfaces[].ipAddresses (primary interface first).
• StableStorageNodeIpCheck asserts every host reports at least one stable admin IP.

STG04-01 — out-of-band failure detection

• query_oob_health.py maps BMC health probes into STG04 failure-category observability (device / network / memory / drive).
• OobFailureDetectionCheck requires BmcSensor and device-category observability per host (distinct from CAP05-01 alert-freeness).

Wiring / docs

• NICo bare_metal.yaml: query_stable_ips + query_oob_health steps (continue_on_failure: true); query_sanitization also marked continue_on_failure.
• suites/bare_metal.yaml: breakfix_skip_sanitization, stable_storage_ips, oob_failure_detection groups.
• suites/README.md step tables + docs/test-plan.yaml label unions updated.

Test plan

• make lint
• make test (full suite)
• uv run pytest isvtest/tests/test_storage_infra.py isvtest/tests/test_breakfix_sanitization.py isvctl/tests/providers/nico/test_nico_provider.py

Closes #358
Closes #359
Closes #360

  

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 414d9f72-133e-4683-844f-645f7739b8da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/nico-stg02-stg03-stg04-d50e

---

_{Comment @coderabbitai help to get the list of available commands.}