ci: persist verified GPU evidence

[domsteil]

Summary

• persist commit-bound evidence for live SFT and GSPO RunPod canaries
• hash the dataset, wheel, adapters, and evaluation output
• record observed GPU, image, duration, actual cost, ceilings, and cleanup confirmation
• require the RL probe to have actually used CUDA and converged
• upload RL evidence as a retained workflow artifact
• AST-parse embedded workflow Python in regression tests

Evidence

• 83 targeted workflow, RL probe, and RunPod tests passed
• every embedded Python heredoc parses successfully
• workflow YAML parses successfully
• Ruff and repository hygiene passed

Safety

This PR does not dispatch or allocate GPU compute. The existing /bin/bash.50-per-job ceilings, 1,200-second RL lifetime, remote self-destruct, and unconditional termination remain in place.