ci: add strict Vulkan GPU gate

[Irk2wd]

Summary

• add a fail-closed 21-mode Vulkan GPU gate derived from the useful self-hosted CI direction in dev_parallel_rhi
• emit a fixed-schema GPU_ENV marker proving selected physical GPU, device UUID, requested/device API, driver, and validation requested/available/enabled state
• harden the Python runner with exact mode/marker semantics, strict Vulkan 1.3 policy, stable evidence, timeout logs, and cross-process GPU identity checks
• protect the persistent GPU runner with a default-branch pull_request_target controller, fork/draft denial, required-reviewer Environment, pinned actions, exact test-merge checkout, pending/final commit status, and serialized generations

Validation

• python -B tools/threading/test_run_parallel_record_vulkan_test.py: 164/164
• strict real-GPU matrix: 21/21 PASS, 0 SKIP, 0 VUID/validation error
  • NVIDIA RTX 5080 0x10de:0x2c02
  • UUID 3b172c4f63b522546e783cce9b27bd48
  • requested Vulkan 1.3.0; device Vulkan 1.4.325
  • validation requested/available/enabled all true
  • all 21 processes reached final Vulkan destruction
• wrong-vendor negative control: failed as expected with evidence retained
• full Debug build: PASS
• Debug CTest: 51/51
• Raster + Sponza editor: first present, 60 s healthy run, WM_CLOSE exit 0, empty stderr, clean Vulkan shutdown
• YAML/PowerShell 5.1/Bash workflow syntax checks: PASS
• two local P0-P2 review rounds: clean after fixes

Deployment note

This PR introduces the first default-branch pull_request_target definition, so GitHub cannot run that new workflow for this PR itself. After reviewed-head approval and the authorized admin merge, dispatch Vulkan GPU Gate on main, approve/bypass the protected vulkan-gpu-persistent Environment, then require the exact Vulkan GPU Gate context in main branch protection.

[Irk2wd]

@codex review

Please review the exact current head a5d0f7a22c6631d04ba17298149b675ba4b69506, focusing on Vulkan instance/debug-messenger teardown, strict 21-mode evidence semantics, pull_request_target trust boundaries, protected Environment approval, pending/final status generation ordering, PowerShell 5.1 execution, and whether the workflow can fail open. Report any remaining P0-P2 issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5d0f7a22c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Irk2wd]

@codex review

Please re-review the exact unchanged head a5d0f7a22c6631d04ba17298149b675ba4b69506. The only prior finding was resolved without a code change because GitHub's current official documentation supports concurrency.queue: max at both workflow and job level: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency#example-queueing-multiple-pending-runs

Please report any remaining P0-P2 issues, checking the current GitHub Actions schema rather than the older two-field concurrency schema.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: a5d0f7a22c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".