[ci]: add fork-safe lint and CPU PR gate

[richardoo-707]

🚨 Issue number

N/A — CI infrastructure change.

📝 What does this PR do?

• Adds a fork-safe pull request gate on GitHub-hosted Ubuntu runners.
• Separates repository lint/formatting from CPU-only unit tests.
• Uses read-only permissions, does not expose repository secrets, and disables persisted checkout credentials.
• Restricts existing private/self-hosted PR jobs that execute unmerged code to same-repository branches.
• Adds an automated runner-policy validator and unit tests.
• Makes the shared pytest setup compatible with the CPU accelerator.

This change builds on the existing runner foundation from E1, reuses the empty-example false-green coverage from E3, and depends on the CPU test subset completed in E4. It does not replace or conflict with those projects.

✅ Test plan

• Changed-file pre-commit checks
• Runner-policy unit tests: 5 passed
• GitHub Actions Lint and formatting
• GitHub Actions CPU unit tests: 18 passed with PyTorch 2.5.1+cpu and no visible GPU
• GitHub Actions two-GPU smoke test
• Workflow YAML and actionlint validation

Two legacy self-hosted change-detection jobs may remain queued when no matching {self-hosted, ubuntu-latest} runner is available; they are independent of the fork-safe gate added here.

💥 Checklist before requesting a review

• I have performed a self-review of my code.
• I have added thorough tests.
• I have documented the new workflow and runner-policy requirements.