ci: persist genpolicy cache on NVIDIA runners

Self-hosted NVIDIA confidential GPU runners receive a clean checkout
for each job, so genpolicy discards useful layer metadata and downloads
the same image layers again.

For CoCo jobs, create a cache under the runner user's home directory
and export GENPOLICY_LAYERS_CACHE_FILE_PATH in the test step that
consumes it. The cache survives workspace cleanup while the environment
variable remains scoped to that process tree.

Use the existing KBS job environment variable in the shell condition so
matrix expressions are not expanded directly into executable code.

Assisted-by: OpenAI Codex <codex@openai.com>
Signed-off-by: Manuel Huber <manuelh@nvidia.com>

.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml

@@ -115,7 +115,14 @@ jobs:
 
       - name: Run tests ${{ matrix.environment.vmm }}
         timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-nv-tests
+        run: |
+          if [[ "${KBS}" == "true" ]]; then
+            cache_dir="${HOME}/.cache/kata-containers/genpolicy"
+            mkdir -p "${cache_dir}"
+            export GENPOLICY_LAYERS_CACHE_FILE_PATH="${cache_dir}/layers-cache.json"
+          fi
+
+          bash tests/integration/kubernetes/gha-run.sh run-nv-tests
         env:
           NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
           ENABLE_NVRC_TRACE: ${{ inputs.enable-nvrc-trace }}