Restructure CI and GPU validation

[jcwal1516]

Summary

• replace the monolithic PR workflow with a fail-closed, change-planned fast path
• move exhaustive release, coverage, compatibility, and audit gates into full-validation.yml
• split CUDA/Metal quick and full validation from benchmark-only GPU work
• make publishing consume manifest-driven, checksum-verified validation evidence
• consolidate quick CUDA validation into one production-feature runtime graph

Why

The previous workflow ran release-grade validation on every pull request and repeated CUDA/Metal feature graphs across several jobs. The initial quick CUDA implementation still rebuilt CUDA-Oxide kernels for Clippy and each exact-inventory command. This version validates the required named hardware tests from one combined runtime result while retaining exact standalone inventories in the full release lane.

Hardware timing

• CUDA quick, cold isolated target: 426.68s (7m07s)
• CUDA quick, warm target: 90.31s (1m30s)
• Metal quick: passed on Apple Silicon

The superseded CUDA quick plan was stopped after more than 11 minutes because it had begun another CUDA-Oxide graph rebuild. The previous full CUDA gate was approximately 30–40 minutes on the same host.

Verification

• python3 -m unittest discover -s scripts/tests -p 'test_*.py' -q
• cargo fmt --all --check
• cargo test -p xtask --quiet
• cargo xtask ci
• cargo xtask clippy-strict
• cargo xtask repo-lint --strict
• cargo xtask release-integrity
• python3 scripts/ci_plan.py plan --base main --head HEAD
• J2K_REQUIRE_METAL_RUNTIME=1 RUST_TEST_THREADS=1 cargo xtask release-metal --mode quick
• J2K_REQUIRE_CUDA_RUNTIME=1 J2K_REQUIRE_CUDA_OXIDE_BUILD=1 J2K_REQUIRE_CUDA_JPEG_HARDWARE_DECODE=1 RUST_TEST_THREADS=1 cargo xtask release-cuda --mode quick

No release was published and no tag was created.