fix(containers): repair GPU builds and model layout

[lusoris]

Summary

Replace Renovate PR #1178 with a release-tested oneAPI builder update. The
production image now builds with Intel's digest-pinned Base Toolkit 2025.3.2
image while truthfully retaining Intel's latest published Ubuntu 24.04 runtime,
2025.3.1. The first exact build exposed Ubuntu's stale Meson 1.3.2 package, so
all three GPU builders now install one checksum-pinned Meson 1.12.0 wheel and
assert the installed version before compiling. A real score smoke also exposed
and fixes a shared extra-model/ directory that made the documented model path
absent in every production target.

Type

• build / ci — tooling / infra
• sycl / cuda / simd — backend-specific

Checklist

• Commits follow Conventional Commits.
• The three production GPU targets build and execute their non-root
  vmaf --version entrypoint as version 3.2.1; all four production targets
  score the fixed 48-frame fixture through the documented bundled model path.
• docker buildx build --check, targeted pre-commit, git diff --check,
  and mkdocs build --strict are green locally.

Bug-status hygiene

• no state delta: this repairs production container construction without
  changing a tracked product bug.

Netflix golden-data gate

• I did not modify any assertAlmostEqual(...) score in the Netflix
  golden Python tests.

Deep-dive deliverables

• Research digest — docs/research/20260831-oneapi-2025-3-2-builder-runtime-compatibility.md records live registry, PyPI, build, and runtime evidence.
• Decision matrix — alternatives and their release/runtime tradeoffs are captured in the research digest.
• AGENTS.md invariant note — no rebase-sensitive invariants: the existing production-container pin policy remains unchanged.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/changed/oneapi-2025-3-2-builder.md.
• Rebase note — compatibility and Meson pin invariants are recorded in docs/rebase-notes.md.

Reproducer

docker buildx build --load --platform linux/amd64 --target cli \
  -f docker/Dockerfile.production -t vmafx-cpu:3.2.1-smoke .
for target in cuda13 rocm7 oneapi2025; do
  docker buildx build --load --platform linux/amd64 \
    --target "final-${target}" -f docker/Dockerfile.production-gpu \
    -t "vmafx-${target}:3.2.1-smoke" .
done
# Mount `testdata/` read-only and score its 48-frame pair in each image with
# model path=/usr/local/share/vmafx/model/vmaf_v0.6.1.json.

Review evidence

• Gemini 3.1 Pro reviewed the change; its one concrete image-layer finding was
  resolved by mounting the wheel stage into each install step instead of
  copying and deleting the wheel. Gemini 3.7 Flash's bounded final-patch
  re-review returned CLEAN.
• Local Qwen3.8-27B raised the split builder/runtime ABI as its only medium
  finding. An in-image ldd gate then resolved every dependency of both
  vmaf and libvmaf.so.3, including libsycl.so.8, libur_loader.so.0, and
  the Intel math runtimes; the executable smoke also remained green. Its two
  low findings are intentionally contained: the remote wheel is content-locked
  by SHA-256 with provenance recorded in the digest, and pip changes only a
  disposable builder stage whose installed Meson version is asserted. Its
  bounded final-diff re-review returned CLEAN.

Known follow-ups

Intel has not published oneapi-runtime:2025.3.2-0-devel-ubuntu24.04. The
runtime remains explicitly pinned to 2025.3.1 until that exact vendor image
exists and passes the same final-image smoke test.