lab: no measurement on a shared GPU (refused / contaminated)

[AdvayMonga]

Stacked on #19 (it uses the container jail's process list). Retarget to main once #19 merges.

Bug

The agent's shell can start GPU processes and leave them running in the background. bench, equiv and submit measured the engine without checking what else was on the GPU. A leftover process could slow a measurement or keep the engine from starting, and the ledger recorded that as the snapshot's result. The base measurement is cached per run, so one contaminated base skewed every later submit.

Fix

• Before launch: serve.Served refuses to start an engine while any process holds the GPU (GpuBusy). No engine is launched.
• While serving: it checks the GPU's processes every second. Anything outside the engine's own processes makes Served.exclusive() raise Contaminated. The engine's processes are its process tree, or the container's processes from docker top.
• Records: bench, equiv, submit and baseline record verdict refused or contaminated, with gpu_processes: [{pid, used_mib, name}]. The agent sees the same facts.
• Consequences of a contaminated run:
  • it is never evidence for submit (bench isn't ok, equiv isn't pass);
  • it is never cached as the base;
  • in submit, it is caught before the holdout guard spends a query.
• lab.validate: the noise-band runs get the same check.
• Why refuse rather than kill: the lab can't yet tell which processes are the agent's. Freeze-and-kill (RUNTIME.md rule 4) comes with the agent container.

Not covered: CPU contention, and a GPU burst shorter than the 1 s poll.

Tested

• Fake GPU process lists:
  • a busy GPU refuses with nothing launched;
  • a foreign process mid-run gives contaminated and leaves no base cache;
  • the engine's own GPU process isn't foreign.
• compute_apps parsing.
• descendants, on Linux.
• The container's pids(), live in Docker-in-Docker.
• Lab suite: macOS 227 passed. Linux 228 passed; the remaining failures are the test box's (old pytest, no git SHA).
• Not tested on a real GPU: whether nvidia-smi --query-compute-apps lists only the engine's processes (DCGM or the lab itself would show up as refused on the first run).

🤖 Generated with Claude Code