fix(tests): update for tempo + cadvisor/nvidia-exporter drift

- test_dashboard.py: tracing backend switched from jaeger to tempo
  in pipeline-performance.json; the test assertion was stale.
- test_compose_mounts.py: exempt cadvisor (privileged: true for
  host metrics) and nvidia-exporter (upstream dcgm-exporter with
  SYS_ADMIN + GPU runtime) from no-new-privileges, matching the
  existing pattern for promtail / zotero / notebooks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/perf/test_dashboard.py

@@ -60,7 +60,7 @@ class TestDashboard:
             if "datasource" in panel:
                 ds_types.add(panel["datasource"]["type"])
         assert "prometheus" in ds_types
-        assert "jaeger" in ds_types
+        assert "tempo" in ds_types
         assert "loki" in ds_types
 
     def test_tags(self):

tests/test_compose_mounts.py

@@ -136,6 +136,8 @@ class TestSecurityOpts:
             "docs",  # static site
             "promtail",  # needs host log access
             "cloudflared",  # tunnel agent
+            "cadvisor",  # privileged: true for host metrics
+            "nvidia-exporter",  # upstream dcgm-exporter, GPU runtime + SYS_ADMIN
         }
         compose = _load_compose()
         missing = []