Add trusted NVIDIA build and test CI

[voltjia]

Problem

NVIDIA behavior is only validated manually on a development host. The project needs a reproducible GPU signal without exposing a self-hosted runner to untrusted pull-request code.

Scope

• Add a separate self-hosted NVIDIA build/test workflow.
• Use explicit runner labels and a public, digest-pinned CUDA/PyTorch image.
• Build CPU+NVIDIA InfiniRT from a fixed public commit on every run.
• Build/install the torch-infini wheel outside the source tree.
• Verify automatic NVIDIA selection and assert Infini/CUDA device-count parity plus allocation/copy tests.
• Initially trigger only on trusted manual runs and pushes to master.

Acceptance criteria

• No private image name, /data/shared mount, preinstalled InfiniRT, environment backend selector, or manual initialization call is used.
• Fork pull requests cannot execute arbitrary code on the self-hosted runner.
• The workflow produces a clear GPU build and test result.

Depends on #2 and the public image/runner-label contract.

[voltjia]

Investigation on 2026-07-23 found that the repository Actions runner API reports zero self-hosted runners. A workflow has intentionally not been added because the required runs-on labels and container GPU-passthrough contract cannot be verified. Before implementation, the repository needs a registered NVIDIA runner, its exact labels, and confirmation that digest-pinned containers receive the GPU. The public image nvcr.io/nvidia/pytorch:24.10-py3@sha256:36555b43d382425a4281ecfbcb41de2f95fb542ca8e531c5486be10df8026f9d can be pulled anonymously, but its PyTorch 2.5.0a0 baseline must be reconciled with the compatibility policy from #12 before adoption.