feat(nemo-agents): add NAT Fabric adapter

[AjayThorve]

Overview

Add a Platform-owned, third-party NeMo Agent Toolkit adapter for NeMo Fabric.
The adapter keeps the referenced NAT workflow YAML authoritative and adds only
the Fabric lifecycle bridge required for invoke-only Platform execution.

This draft is stacked on #865 and should be retargeted to main after #865
merges.

The change:

• installs nvidia.nemo.platform.nat metadata in the wheel data directory
  discovered by NeMo Fabric after fix: discover installed adapter descriptors NVIDIA/NeMo-Fabric#108;
• loads one NAT workflow during start_runtime, invokes it through NAT
  SessionManager / runner.result(), and closes it during stop;
• translates kind: nat without synthesizing Fabric models, skills, or
  telemetry, and rejects those Platform-owned fields instead of ignoring them;
• adds lifecycle, translation, packaging, and installed-discovery coverage;
• adds a minimal email-phishing analyzer run example based on the existing NAT
  component.

NAT serve, streaming, durable Platform sessions, and Platform model/tool/MCP
normalization are intentionally out of scope.

sequenceDiagram
    participant Platform
    participant Fabric
    participant Adapter as "NAT adapter host"
    participant NAT

    Platform->>Fabric: agent.yaml + input
    Fabric->>Adapter: start(runtime context, config_file)
    Adapter->>NAT: enter load_workflow(config_file)
    NAT-->>Adapter: SessionManager

    Fabric->>Adapter: invoke(request)
    Adapter->>NAT: SessionManager.session(...)
    Adapter->>NAT: session.run(input, RUN_OR_SERVE)
    Adapter->>NAT: runner.result()
    NAT-->>Adapter: workflow result
    Adapter-->>Fabric: normalized success/failure output

    Fabric->>Adapter: stop(runtime_id)
    Adapter->>NAT: exit load_workflow context
    NAT->>NAT: shutdown sessions, builders, components

Loading

Where should the reviewer start?

Start with
plugins/nemo-agents/src/nemo_agents_plugin/fabric/adapters/nat/adapter.py,
then review the descriptor packaging in plugins/nemo-agents/pyproject.toml
and the NAT branch in
plugins/nemo-agents/src/nemo_agents_plugin/fabric/translator.py.

Validation

• ruff check and ruff format --check on the changed Python files
• 47 focused Fabric/NAT unit tests
• installed-discovery integration test through the real Platform -> Fabric ->
  NAT subprocess boundary
• plugin wheel inspection confirmed both the adapter module and
  share/nemo-fabric/adapters/nemo-platform-nat/fabric-adapter.json
• email-phishing NAT workflow successfully started and stopped through Fabric
  without invoking the external model

The installed-discovery E2E used NeMo Fabric native runtime built from merged
NVIDIA/NeMo-Fabric#108 (c8bc400) because the post-#108 PyPI build is not
available yet.

Draft blocker

The dependency pins assume the first post-#108 build,
0.1.0a20260724. Regenerate uv.lock and the license artifacts after that
release is available on PyPI.

Related Issues

• Relates to FABRIC-117
• Depends on fix(nemo-agents): update fabric adapter compatibility #865
• Requires fix: discover installed adapter descriptors NVIDIA/NeMo-Fabric#108