test(e2e): run gpu workloads from manifest

[elezar]

Summary

This PR adds manifest-driven GPU workload execution tests on top of the workload image artifacts from #1484. It keeps the existing GPU device-selection coverage, adds workload execution coverage under the umbrella gpu target, and documents how to build workload images locally before running the GPU e2e suite.

This branch is now rebased on the local e2e stabilization fixes from #1935, so the Docker GPU test path also includes the supervisor-image and host SSH linker-environment fixes needed for local Nix/devenv runs.

Related Issue

Closes #1472

Changes

• Switch GPU workload execution tests from a single image env var to a YAML workload manifest consumed by the Rust e2e harness.
• Run the manifest-defined workloads through openshell sandbox create --gpu --from <image> -- <command> and enforce declared pass or fail expectations.
• Load the local manifest from e2e/gpu/images/.build/workloads.yaml by default, with OPENSHELL_E2E_WORKLOAD_MANIFEST available for external manifests.
• Update the Docker GPU e2e wrapper to point users at the workload manifest flow when no local manifest exists.
• Add serde_yaml to the e2e crate for manifest parsing.
• Include the local e2e fixes from fix(e2e): stabilize local Docker smoke test #1935: configured Docker supervisor image handling and host SSH linker-environment isolation.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Validation status:

• mise run e2e:docker:gpu
• mise run pre-commit was run after rebasing onto main; Rust format/check/clippy, markdown lint, Python format, license checks, and docs checks completed successfully.
• mise run pre-commit currently fails in helm:lint because the local chart dependency directory is missing the postgresql dependency. This is unrelated to the GPU workload changes.

GPU validation commands for future runs:

• mise run e2e:workloads:build
• mise run e2e:docker:gpu

Notes:

• Build workload images and generate the local manifest with mise run e2e:workloads:build before running mise run e2e:docker:gpu locally.
• External catalogs can be exercised by setting OPENSHELL_E2E_WORKLOAD_MANIFEST=/abs/path/to/workloads.yaml.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1709.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e-gpu applied for 2f36b22. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e applied for 2f36b22. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.