ci: wire GPU checks to patched vLLM nightly image

[yubofredwang]

Summary

The GPU CI dispatcher currently launches with VLLM_USE_V2_MODEL_RUNNER=1, but the nightly Docker publisher still builds the old v0.22.1 image. That image does not support the extract_hidden_states V2 path, causing the GPU smoke to fail during vLLM configuration before training starts.

This PR:

• switches the nightly publisher to the validated e9d1398d9edfd90fcc1cf783805240e3effec013 patched vLLM Dockerfile;
• publishes the immutable nightly-<short-sha>-vllm-pp and moving nightly-vllm-pp tags;
• records the TorchSpec source SHA in the image label;
• adds a trusted Slurm preflight that checks the vLLM build commit, base image tag, V2 runner setting, and extract-hidden-states patch markers;
• documents that TORCHSPEC_CI_IMAGE must point to an ARM64 .sqsh made from nightly-vllm-pp.

Validation

• git diff --check
• bash -n tools/ci/dispatch_slurm.sh tools/ci/gpu_2gpu.sbatch
• embedded runtime Python syntax compilation
• YAML parsing for all three affected workflows

Required post-merge infrastructure update

The repository secret TORCHSPEC_CI_IMAGE must be updated to the Inkwell ARM64 .sqsh imported from lightseekorg/torchspec:nightly-vllm-pp. The new preflight will report the expected and actual image metadata if the old .sqsh remains configured.