fix(cdi): bound refresh restart attempts

[kvnloo]

Summary

The packaged CDI refresh service already gets TimeoutStartSec=90s from 10-container-engines.conf. This keeps that timeout policy and makes the restart-rate window long enough that the sixth start remains inside the same window even when every failed attempt consumes the full timeout.

Changes

• keep StartLimitBurst=5
• use StartLimitInterval=10min
• preserve packaged TimeoutStartSec=90s
• use the backward-compatible [Service] spelling
• assert effective timeout, burst, and interval in E2E coverage
• run the assertion hermetically in normal Go CI

Validation

Green downstream:

• build
• lint/check
• unit tests
• CodeQL
• hermetic CDI refresh restart-limit regression

systemd v219 and current source were checked for directive compatibility. All commits are DCO-signed.

Fixes #2110

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.