Closes#1599
## Summary
- Repo-side foundation of the CI dependency / cache redesign — additive
and files-only; nothing consumes these files yet (the workflow cutover
is a separate follow-up).
- `constraints.txt`: single source of exact version pins for the
CI/runner stack (torch, triton, apache-tvm-ffi, and tilelang runtime
deps).
- `scripts/ci/install_tileops.sh`: requires `tilelang` already present,
then `pip install -e . --no-deps -c constraints.txt`; fails clearly if
tilelang is missing (so pip cannot drift torch / apache-tvm-ffi).
- `.github/runner/Dockerfile`: rewritten as a multi-stage build from the
public `nvidia/cuda:12.9.1-devel-ubuntu22.04` base (`runtime` builds
python3.12 via the deadsnakes PPA → `post-fa3` → `fullstack` → `final`);
bakes no TileOPs source and no runner credentials.
## Test plan
- [x] AC-1: `constraints.txt`, `scripts/ci/install_tileops.sh`, and the
rewritten multi-stage `.github/runner/Dockerfile` exist with the
requested structure (stages runtime/post-fa3/fullstack/final, public
CUDA 12.9.1 base, constraints-only Docker COPY, tilelang preflight,
`--no-deps` install).
- [x] AC-2: `scripts/ci/install_tileops.sh` passes `shellcheck` (0.11.0,
no diagnostics).
- [x] AC-3: `.github/runner/Dockerfile` passes `hadolint
--failure-threshold error` (2.12.0; only warning/info findings).
- [ ] AC-4: **DEFERRED-TO-MANUAL on a GPU build host.** The image is
intentionally NOT built in CI by this issue. Manual validation (image
builds; `torch.version.cuda == "12.9"`; `tilelang` imports; cuBLAS
matmul/bmm/einsum probe passes; `pytest -m smoke` passes) is performed
by a maintainer on a host with an NVIDIA GPU + nvcc. Reviewers should
not expect a CI image build here.
---------
Co-authored-by: Ibuki 🍃 — a wind born from GPTs <Ibuki-wind@users.noreply.github.com>
Cao Ying