feat: add GPU workload sandbox images

[elezar]

Summary

• Add flat sandboxes/gpu-workload-* images for smoke-pass, smoke-fail, and cuda-basic validation.
• Keep the workload contract in the per-image READMEs: /usr/local/bin/openshell-gpu-workload, stable success and failure markers, no runtime network dependency, and direct ENTRYPOINT execution.
• Update the sandbox image workflow so GPU workload images are validated as linux/amd64,linux/arm64 in PRs as well as published multiarch on main.
• Document CUDA sample source and NGC CUDA builder inputs in THIRD-PARTY-NOTICES.

Related

• test(e2e): define GPU validation image artifacts OpenShell#1476
• test(e2e): add GPU workload image artifacts OpenShell#1484

Validation

• python3 scripts/check_license_headers.py --check
• ruby -e "require \"yaml\"; YAML.load_file(\".github/workflows/build-sandboxes.yml\"); puts \"ok\""
• git diff --check
• bash -n sandboxes/gpu-workload-smoke-pass/workload.sh
• bash -n sandboxes/gpu-workload-smoke-fail/workload.sh
• bash -n sandboxes/gpu-workload-cuda-basic/workload.sh
• docker build -t openshell-gpu-workload-smoke-pass:test sandboxes/gpu-workload-smoke-pass
• docker build -t openshell-gpu-workload-smoke-fail:test sandboxes/gpu-workload-smoke-fail
• docker build -t openshell-gpu-workload-cuda-basic:test sandboxes/gpu-workload-cuda-basic
• docker run --rm openshell-gpu-workload-smoke-pass:test exits 0 and prints OPENSHELL_GPU_WORKLOAD_SUCCESS smoke-pass
• docker run --rm openshell-gpu-workload-smoke-fail:test exits 42 and prints OPENSHELL_GPU_WORKLOAD_FAILURE smoke-fail intentional failure
• GitHub Actions passed all PR checks, including multiarch build validation for all three workload images.

Not Run

• Direct gpu-workload-cuda-basic runtime execution with --device nvidia.com/gpu=all; this local Docker Desktop environment does not provide NVIDIA GPU/CDI injection.