ci: add Gym GPU test workflow

[chtruong814]

Summary

• add the main Gym CI workflow with preflight, unit tests, container build, GPU test matrix, and aggregate status check
• add shared Gym change classification so docs-only behavior matches the unit-test workflow without label overrides
• add a simplified CPU/GPU container test action and an initial nvidia-smi E2E placeholder

Testing

• pytest tests/unit_tests/test_ci_environment.py -q
• pre-commit run --files .github/actions/classify-changes/action.yml .github/actions/test-template/action.yml .github/workflows/cicd-main.yml .github/workflows/unit-tests.yml tests/e2e/gpu_e2e_test.sh tests/unit_tests/test_ci_environment.py
• YAML parsing, Bash syntax validation, and git diff --check

[kajalj22]

/claude review

[claude]

SHIP — LGTM, no reliability concerns.

CI/CD plumbing only; no verifier/scorer/async/public-API surface touched. Traced the failure modes that matter for this diff:

• Aggregate gate is sound. Nemo_CICD_Test (always() && !cancelled()) requires unit_tests + container_build + gpu_e2e_tests all success on the non-docs path, or all skipped on docs-only. A failed unit_tests skips the needs-chained downstream jobs, so neither branch passes → exit 1. No path yields green on a real failure.
• Classification stays consistent. cicd-main classify_changes and unit-tests detect both invoke the shared classify-changes action with the same pre-flight base_ref. unit-tests' force-run-all only triggers on empty base-ref and only escalates toward the full suite (safe direction — never under-tests).
• No double runs. unit-tests.yml has no push trigger, so on internal pull-request/[0-9]+ pushes it runs only via cicd-main's workflow_call; GitHub pull_request runs it standalone.
• test-template uses continue-on-error + explicit exit 1 in the always() report step, correctly failing the job while emitting the summary. All shell interpolation goes through quoted env vars — no injection surface.

New test_ci_environment.py assertions check real wiring (job deps, docs_only gating counts, container push, classifier paths), not vacuous pass-throughs.