[dmivor]

Improve binary mode kernel lock warnings, DKMS registration, and Debian/Ubuntu package handling

• Pass --dkms and --tmpdir=/var/tmp (TMPDIR=/var/tmp) to the NVIDIA .run
  installer in _binary_install_driver() so module sources are registered in
  DKMS (enabling automatic/offline rebuilds when kernel headers are installed)
  and preventing /tmp tmpfs exhaustion during BTF encoding on smaller VMs.
• Install a kernel post-install hook (/etc/kernel/postinst.d/zz-gcp-gpu-header-check)
  and emit an explicit CLI warning when lock_kernel_updates() runs in binary
  mode, alerting administrators (via stderr and syslog) if a new linux-image-*
  package is installed by third-party patch tools without matching linux-headers-*.
• Fix DebianInstaller._install_prerequisites() to compare kernel patch versions
  numerically (key=lambda x: int(x[0])) rather than lexicographically when
  patch numbers exceed 100 (e.g., 6.12.107 vs 6.12.96).
• Update UbuntuInstaller to derive kernel meta-packages dynamically from the
  running kernel flavor (_get_kernel_meta_packages()) and fix
  _repo_uninstall_driver() to unhold and remove the matching driver package
  (nvidia-driver-open on Ubuntu 24.04/26.04, nvidia-open on 22.04).
• Update linux/README.md to clarify that repo mode is the default and only
  binary mode locks kernel updates.