feat(training): add Colab GPU recognition runner

[e54-bot]

Summary

• Add an OCRKit-owned Colab CLI runner around the existing recognition training and fixture evaluation scripts.
• Stage the selected reviewed train/holdout labels and referenced crops, provenance, required source and evaluator inputs, and pretrained checkpoint; verify staged and returned checksums.
• Add CUDA-aware PaddlePaddle setup with a selectable GPU preference, explicit compatibility checks, and runtime teardown on provisioning and execution failures. Keep local CPU training available.

Verification

• bash -n training/bootstrap.sh training/setup_rec_environment.sh training/run_rec_smoke.sh
• python3 -m py_compile training/run_rec_colab.py training/colab_remote.py
• Mocked Colab CLI runs covered success, training failure, evaluation-gate failure, and GPU provisioning failure; failure paths stopped the runtime and did not create top-level success artifacts.
• Mocked CUDA setup covered a supported GPU and rejection of compute capability 7.5.
• No live Colab GPU allocation or training run was performed.

Closes #20

[Teakowa]

Teardown failure handling needs correction.

[Teakowa]

If colab stop returns nonzero after an earlier provisioning/training error, error is already set, so the manual teardown command is never recorded. The runtime may remain allocated, while status.json only contains the original failure. Always include colab stop -s <session> when stop fails, even when another error occurred.

[Teakowa]

Review of the Colab GPU runner. The design fits #20: a thin adapter over the existing smoke/evaluation scripts, private inputs staged as a checksummed archive, no publish/promote path, teardown in finally. Three items need fixing before merge.

Must fix

1. Colab CLI semantics are unverified. colab new -s … --gpu, upload, exec -f, download, stop -s, and the assumption that exec propagates the script exit code were only exercised against mocks. The failure/teardown contract depends on them; one real run or a check against the CLI is needed.
2. A failed run can leave success-looking output. copy_remote_result (success branch) copies checkpoint/, evaluation/ and run.json into run_dir before the run is final. A later failure (partial copy, teardown failure, status check) leaves them in place. Stage into a temp dir and rename only after teardown succeeds; otherwise move under partial/.
3. No committed tests. The mocked scenarios (success, training failure, gate failure, GPU provisioning failure, unsupported compute capability) exist only in the PR description. Commit them as a focused test and confirm they fail when teardown or the gate check is removed.

Should fix

• run_request["training"] hardcodes batch size, first_bs, eval_batch_step and thresholds duplicated from the shell scripts, so the recorded "effective configuration" can drift from what ran. The 0.9604221635883905 gate now lives in three places.
• setup_rec_environment.sh: unrelated BASH_SOURCE[0] → $0 change and ${var} → $var churn; CUDA path installs, uninstalls and reinstalls Paddle (double download).
• ocrkit_worktree_dirty is recorded but a dirty tree's revision does not identify the staged code.

Minor

• No timeout/idle bound on colab exec.
• If exec fails before the result archive exists, the download error masks the real failure.
• Confirm paddlepaddle-gpu==3.3.1 exists on the cu129 index.