cp: verify downloaded yq binaries on main

[svcnemo-autobot]

Background

Cherry-picks commit 59bbfaf318b5bf3cb0297c68ccbdacd515536b57 from #6344 onto main.

What changed

• Verify downloaded yq binaries against pinned SHA-256 checksums.
• Retain main deletions while resolving modify/delete conflicts.
• Preserve cherry-pick provenance with git cherry-pick -x.

Details

flowchart LR
    A[Download yq] --> B[Verify SHA-256]
    B --> C[Install executable]

Loading

The surviving source patch applies unchanged to the three CI Dockerfiles.

Tested

• BASE_REF=main CHECK_ONLY=true SKIP_DOCS=false bash tools/autoformat.sh
• Verified source and cherry-pick patch IDs match for surviving files.
• Downloaded amd64 and arm64 yq v4.44.1 binaries and verified both pinned checksums.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

This PR has been automatically converted to draft because all PRs must start as drafts.

When you are ready for review, click Ready for Review to begin the review process. This will:

1. Add the oncall reviewer (optional reviewer)
2. Add required review teams based on your changes

See the contribution guide for more details.

[svcnvidia-nemo-ci]

/ok to test 4ae1ef3