Add a GPU lane to up through --accelerator

What

up --accelerator <accelerator-type>=<count> (or SIM_ACCELERATOR) creates a rig with a GPU through the engine, so nobody hand-rolls gcloud compute instances create. Closes #19 (closed).

Why

A hand-rolled create drops the labels, SIM_OWNER, the --max-run-duration auto-delete and down by name. The accelerator rides the same create, so every net stays.

How

flowchart TD
  A[up] --> B{accelerator set?}
  B -- no --> C[create VM: Podman, as before]
  B -- yes --> D{omnibus base and explicit machine type?}
  D -- no --> X[refuse before creating anything]
  D -- yes --> E[create VM with --accelerator and --maintenance-policy=TERMINATE, labels, owner, auto-delete, sim-gpu=true, gpu=true]
  E --> F{zone has the accelerator?}
  F -- no --> G[try the next zone that offers both]
  G --> E
  F -- yes --> H[startup.sh: driver, Docker, NVIDIA Container Toolkit]
  H --> I[runner registers over Docker with --docker-gpus all]
  C --> J[down by name]
  I --> J

• simulation.sh: the flag and env, validation, the create flags, a zone fallback that also requires the accelerator, and the runner registration over Docker.
• startup.sh: reads sim-gpu from the instance metadata and ensures the NVIDIA driver, Docker and the NVIDIA Container Toolkit. Rootful Podman does not expose a GPU to GitLab Runner, so the lane leaves /var/run/docker.sock to Docker. set -E carries the failure trap into the new function.
• gce/operations.md: a short GPU lane section. CHANGELOG.md, SKILL.md pointer, lab.just comment.
• Self-test: the flags, the nets, the refusals, the zone skip and the runner registration.

The caller supplies the accelerator type, count and machine type; nothing here names one.

Boundaries

• The lane runs the omnibus base only. caproni and dev are built on Podman.
• The boot image stays fedora or almalinux-9. The bootstrap scripts are dnf-based, so a Debian-family GPU image cannot run them.

Verification

• just ci passes, including the engine self-test and vale parity.
• main already failed word-budget (52322 words against the 52000 ceiling), so the second commit tightens prose across the loaded Markdown, with no fact or command dropped, to 51997.
• Not run: a live create with an accelerator. The driver, Docker and toolkit install on a real GPU VM is untested.