ci: (PR 1/2) add the hermetic CPU contract suite

[Luodian]

We need a repeatable CPU check before changing the evaluation pipeline. This adds a pinned Linux environment, fixes test collection, and exercises the production request constructors without downloading datasets.

Scope

• Collect the full test tree and run the CLI, registry, protocol, request, task, evaluator, and subprocess contracts offline.
• Mark the Qwen2.5-VL integration test as GPU-only and supply the dependencies needed during collection.
• Match the current Ruff configuration in the pinned requirements and test imports.

Validation

Rebased onto main at e0bfc699 on September 5, 2026.

• Full collection: 680 tests, no collection errors in the local environment.
• The workflow's seven-file CPU contract command: 177 passed locally.
• uv run --no-sync pre-commit run --all-files: passed.
• The pinned Python 3.11 Linux environment is validated by the Hermetic CPU Contracts workflow on this PR.

This adds the check but does not change branch protection. Requiring it is a separate repository setting.

Dependencies

Foundation stack: #1440 -> #1451. The sample-limit fix in #1441 also depends on this PR. This PR introduces no new evaluation lifecycle or model-reuse behavior.