[ci] establish baseline CI/CD checks

[wheresmyhair]

Establishing baseline CI/CD checks

Summary

This PR establishes the initial CI/CD baseline for LMFlow with fork-safe GitHub Actions workflows, offline CPU tests, lint checks, package validation, and GitHub Pages deployment.

Motivation

• Previously we lacked a reliable CPU-only test workflow and package build validation. Several tests also depended on local datasets, network access, GPUs, or optional inference backends, making them unsuitable for standard pull request checks.

• The documentation workflow attempted to deploy on pull requests, which could fail for contributions from forks due to restricted token permissions.

Changes

CI

• Add a new CI workflow with:
  • High-confidence Ruff checks
  • Offline CPU tests on Python 3.9
  • Source distribution and wheel builds
  • Twine validation
  • Wheel installation and package metadata verification
• Pin GitHub Actions to immutable commit SHAs.
• Use read-only repository permissions by default.
• Add concurrency limits and job timeouts.

Test isolation

• Configure pytest to collect tests only from tests/.
• Add markers for:
  • GPU tests
  • Slow tests
  • Tests requiring network access
  • Tests requiring optional inference backends
• Replace missing repository-local dataset dependencies with temporary test fixtures.
• Mock pipeline initialization where tests only need to validate class selection.
• Handle partially installed optional backends without failing test collection.
• Fix ToolInferencer tests and use the active Python interpreter for code execution.

Documentation

• Separate documentation building from deployment.
• Build documentation for pull requests without requesting deployment permissions.
• Deploy GitHub Pages only from main.
• Replace the previous gh-pages branch deployment action with the official GitHub Pages artifact workflow.

Packaging

• Replace the unsupported requires_python setup argument with python_requires.
• Validate Requires-Python >=3.9 in the built wheel metadata.

Validation

The following checks were run locally:

• actionlint: passed
• Ruff high-confidence checks: passed
• Offline CPU tests: 26 passed, 3 skipped, 22 deselected
• Source distribution and wheel build: passed
• Twine validation: passed
• Wheel installation and metadata validation: passed
• Sphinx documentation build: passed

The documentation build currently reports 211 pre-existing warnings. Warning cleanup and enabling warnings-as-errors are intentionally deferred to a separate PR.

[research4pan]

LGTM