feat(grpo): add DPPO and typed async rollout providers

[luke-lombardi]

What does this PR do?

Add DPPO and a typed extension point for complete asynchronous tool rollouts. External providers own generation, terminal verification, group admission, and reward shaping; NeMo owns replay, bounded concurrency, policy lag, and training.

• loss_fn.dppo_epsilon enables the binary-TV DPPO mask, using actual behavior logprobs and the full assistant-token denominator.
• RolloutProvider.generate_groups(RolloutRequest) returns complete RolloutGroupResult objects. Rejected groups request fresh draws; missing, duplicated, malformed, or failed streams fail explicitly.
• Native rollouts preserve sampled tokens and terminal metadata, support deadlines, and can finalize submissions at rollout limits. SGLang provides a serializable non-owning client with request-specific abort/drain; collector starts and refit pauses share an atomic gate. Failed batches drain sibling requests, streams close before worker release, and fatal drain errors block refits.
• Optional rollout grouping keeps independent draws of identical prompts separate when computing advantages.

The companion models harness implements the paper workflow through this provider. NeMo has no paper-specific configuration or task/reward logic.

Issues

None.

Usage

See the GRPO guide for DPPO and the provider contract. Configure an external provider with grpo.async_grpo.rollout_provider: {class_path, kwargs}. The default remains the built-in rollout pipeline, prompt-content grouping, and existing loss.

Before this PR is ready for review

• Followed contributor guidelines; commits are signed off.
• Added focused objective, provider, collector, rollout, and transport regressions.
• Updated configuration examples and the existing GRPO guide.
• Run the full unit/functional suite and eight-GPU smoke test on the configured Linux/CUDA host.

Validation

• 82 regression cases passed with actual NeMo imports: 29 DPPO, 11 advantage, five provider-factory, 24 collector, nine native-rollout, and four SGLang transport cases. Generation/HTTP/environment calls are mocked; the collector is instantiated locally.
• 17 GRPO configuration/logprob cases and eight existing advantage-validity cases passed against actual source bodies with distributed dependencies isolated. The full GRPO module could not start its Ray fixtures inside the macOS sandbox.
• The companion harness passed 25 provider/config tests, including five fully inherited NeMo recipes, and 26 Leaf tests using real Docker, the Qwen tokenizer, and NeMo CPU environment interfaces. Its lightweight harness/storage suite also passed.
• GRPO/PPO configuration parity, pinned Ruff, formatting, and diff checks passed. The public provider, collector, advantage helper, native rollouts, and generation interface pass pinned Pyrefly; the models provider passes its strict type check.

These checks do not establish live distributed SGLang decoding/refits, CP=2 backward passes, or long-context GPU memory fit. The companion harness retains the GPU smoke target for that validation.