[codex] Add asset materialization POC

[ishandhanani]

Summary

Adds an explicit srtctl ensure-assets POC for cluster-side model and container alias materialization.

• Adds asset_materialization cluster config schema and example configuration.
• Adds core materialization logic that can run configured pull/import templates on the login node or through an srun wrapper, with auto mode driven by a login-node probe.
• Updates missing model_paths and containers aliases in srtslurm.yaml with locking and atomic writes.
• Adds JSON output for callers such as IBAR.

Identity behavior

The materializer uses the recipe identity block as provenance:

• identity.model.repo and identity.model.revision feed model pull templates.
• identity.container.image feeds container import templates.

It does not rewrite the recipe or mutate identity fields. After aliases are registered, normal config loading resolves model.path and model.container to cluster paths while preserving identity for runtime fingerprint verification.

Validation

• uv run ruff format --check src/srtctl/core/assets.py src/srtctl/core/schema.py src/srtctl/cli/submit.py tests/test_assets.py
• uv run ruff check src/srtctl/core/assets.py src/srtctl/core/schema.py src/srtctl/cli/submit.py tests/test_assets.py
• uv run pytest -q

Full test result: 603 passed, 2 skipped, 6 deselected.