PR-D: Temporarily disable ci-gpu gpu_public lane with fail-fast guard

[lmeyerov]

Summary:
Temporarily lock down the GPU CI workflow while gpu_public is unavailable and PR-D hardening is pending.

Changes:

• Add gpu-disabled-guard job that fails fast when GPU-triggered paths are invoked (workflow_dispatch, repository_dispatch, labeled PRs with gpu-ci)
• Temporarily disable gpu-permission, cancel_outstanding, and test-full-ai jobs via if: ${{ false }}
• Add explicit inline comments in ci-gpu.yml referencing issue Umbrella: Harden untrusted PR CI + Codex agent security model #1130 for re-enable criteria
• Add changelog entry documenting temporary GPU lockdown

Why:

• Prevent untrusted or accidental execution on unavailable or non-hardened gpu_public runners
• Keep trigger path visible with actionable failure instead of silent skip

Re-enable criteria:
Re-enable only after issue #1130 acceptance criteria are met (self-hosted/GPU isolation plus promotion gate).

Closes part of #1130.