feat(cli): judge / auxiliary-model resources-server scaffold template (M6g)

[wprazuch]

What

Adds a reusable LLM-as-judge / auxiliary-model resources-server template and a --template
option to ng_init_resources_server. Today the four LLM-as-judge servers each re-implement the
same "call another model from verify()" wiring by hand; this gives new servers one shared
starting point.

# default basic verifier (unchanged)
ng_init_resources_server +entrypoint=resources_servers/my_server

# verifier that calls a judge / reward model / subagent
ng_init_resources_server +entrypoint=resources_servers/my_judge +template=judge

The judge scaffold generates:

• a config block wiring judge_model_server (referenced by name, like policy_model) and
  judge_responses_create_params into the resources server;
• an app.py whose verify() calls the auxiliary model via server_client.post(... /v1/responses),
  with a bounded concurrency semaphore and a clamped 0..1 reward parser (_parse_reward,
  meant to be swapped for label/JSON parsing);
• a matching test_app.py covering construction and reward parsing.

Scope

Additive only. The default basic template is unchanged, and the existing judge servers
(equivalence_llm_judge, arena_judge, aalcr, …) are not refactored onto this base —
consolidating them is a separate, owner-sensitive change. This PR just makes the shared pattern
available to new servers (and to a future ng init env wizard / M6h).

Tests

• test_init_resources_server_judge_template — asserts +template=judge scaffolds the judge
  config (judge_model_server/judge_responses_create_params) and the judge app + test templates.
• The scaffolded test_app.py (shipped as judge_resources_server_test_template.py) covers the
  app logic (construction, _parse_reward number-extraction and zero fallback) inside a generated
  server.
• The two template files are added to coverage omit — they're copied verbatim into generated
  servers and run there, not imported in-process (same class as the already-omitted
  environments/*/prepare.py).

Part of the configuration-friction epic (#1205), friction #2/#7. Targets
wprazuch/init-config-docs since it extends the same init_resources_server flow (and reuses its
inline-docs + source: config style).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.