NVIDIA Container Escape CVE 2025-23266 (aka NVIDIAEscape)

First part of the series. How does the NVIDIA Container Toolkit work, and which mechanisms enable NVIDIAEscape?