GPU driver DINE policy assignment fails remediation: system-assigned identity granted no role (roleDefinitionIds not passed to policy-assignment module)

[ThojoUno]

What happened? Provide a clear and concise description of the bug, including deployment details.

Describe the bug

The GPU driver policy assignment module creates a policy assignment with a
system-assigned managed identity, but never grants that identity any role.
As a result, the DeployIfNotExists (DINE) remediation task fails because its
identity has no permission to create the remediation deployment.

Affected module: workload/bicep/modules/azurePolicies/gpuExtensionsSubscriptions.bicep

Error

Remediation (and the manually triggered remediation task) fails with:

Evaluation of DeployIfNotExists policy was unsuccessful. The policy assignment
'.../policyAssignments/' resource identity does not have
the necessary permissions to create deployment '.../deployments/PolicyDeployment_'.
Please see https://aka.ms/arm-policy-identity for usage details.

Root cause

The gpuPolicyAssignmentsCompute module invocation passes identity: 'SystemAssigned'
but does not pass roleDefinitionIds:

module gpuPolicyAssignmentsCompute '../../../../avm/1.0.0/ptn/authorization/policy-assignment/modules/resource-group.bicep' = [for (customPolicyDefinition, i) in varCustomPolicyDefinitions: {
    scope: resourceGroup('${subscriptionId}', '${computeObjectsRgName}')
    name: 'Policy-Assign-${customPolicyDefinition.deploymentName}-${time}'
    params: {
        name: customPolicyDefinition.libDefinition.name
        displayName: customPolicyDefinition.libDefinition.properties.displayName
        description: customPolicyDefinition.libDefinition.properties.description
        identity: 'SystemAssigned'
        location: location
        policyDefinitionId: gpuPolicyDefinitions[i].outputs.resourceId
        // roleDefinitionIds NOT passed
    }
}]

### Steps to reproduce
Deploy the GPU extension policies via gpuExtensionsSubscriptions.bicep (the Bicep/AVM path, not the portal).
Deploy (or already have) a matching GPU session-host VM in the target resource group.
Let the DINE policy evaluate, or run the remediation task manually.
Remediation fails with the "resource identity does not have the necessary permissions to create deployment" error above.

### Expected behavior
The policy assignment's system-assigned identity should automatically receive the
role(s) the policy definition requires, scoped to the target resource group, so the
remediation task succeeds without a manual role-assignment step.

### Proposed fix
Pass the role IDs from the policy definition straight through to the assignment
module, keeping declared and granted roles in sync:


        policyDefinitionId: gpuPolicyDefinitions[i].outputs.resourceId
        roleDefinitionIds: customPolicyDefinition.libDefinition.properties.policyRule.then.details.roleDefinitionIds
(The AMD and NVIDIA definitions currently declare Contributor. Consider narrowing
these to Virtual Machine Contributor — 9980e02c-c2be-4d73-94e8-173b1dc7cf3c —
since the remediation only writes a Microsoft.Compute/virtualMachines/extensions
resource and creates its deployment; Contributor is broader than required.)



### Please provide the correlation id associated with your error or bug.

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

### What was the expected outcome?

_No response_

### Relevant log output

```Shell