CI: harden build-wheel.yml for the eMudhra/emSign CA incident (13.4.x backport) - #3305

… backport)

Backport the CI hardening that main received for the eMudhra/emSign CA key
compromise (CVE-2026-111943, CVE-2026-115557), so that wheels released from
this branch are built with patched tooling and verified downloads:

- install-sccache: pin rapidsai/sccache v0.18.0-rapids.7 and verify its
  sha256 instead of piping releases/latest into sudo tar (NVIDIA#3248). Also use
  it in test-sdist-linux.yml instead of mozilla-actions/sccache-action.
- GPU driver installers: verify DRIVER_SHA256 before running them as
  root/admin, with a test-matrix check (NVIDIA#3249).
- upgrade-ca-certificates: upgrade ca-certificates on GitHub-hosted Linux
  and distrust the compromised intermediates on GitHub-hosted Windows, in
  build-wheel.yml, coverage.yml, test-sdist-windows.yml and the Windows
  pre-commit job in ci.yml (NVIDIA#3270).
- setup-hardened-python: install interpreters with a pinned uv and fail on
  unpatched ones, replacing actions/setup-python + harden-pip (NVIDIA#3275). This
  branch still builds and tests Python 3.10, which has no fixed release; for
  series older than 3.11 the action warns and installs pip from the
  sha256-pinned 26.2.2 wheel instead of failing. cibuildwheel now runs with
  the hardened host Python (`python-path`).
- cibuildwheel: use build[uv] with UV_* constraints, as main does (NVIDIA#2964),
  so build dependencies are not fetched by the pip that cibuildwheel
  provides. Drop the dummy wheel test stage (sccache stats are dumped during
  repair) and the `before-build = "pip install delvewheel"` overrides.
- fetch_ctk: verify the CTK redistrib JSON against a pinned sha256 and every
  component archive against the sha256 in that JSON before extracting it,
  failing closed on a mismatch (new `component-sha256` and `verify-metadata`
  subcommands in ci/tools/fetch_ctk_redistrib.py, with tests).

Not backported: the runner trust probe, the "Enable Git symlinks" steps, and
the lychee/pre-commit workflows, which do not exist on this branch.

Refs NVIDIA#3195

…e.yml

…ntainer

Two follow-ups from CodeRabbit review of the eMudhra hardening backport:

- fetch_ctk: add 'verified' prefix to CTK_CACHE_KEY / CTK_CACHE_FILENAME so
  that cache entries written before the hash-verification logic was introduced
  cannot hit and bypass the new verify-metadata / archive SHA-256 checks.

- test-wheel-linux: upgrade ca-certificates inside the ubuntu:22.04 test
  container before its first HTTPS operation. The host-level
  upgrade-ca-certificates action does not affect the container, so the
  container's trust store could otherwise still accept the compromised
  eMudhra/emSign intermediates.

…ve fix

Finding 1 (ci-nightly.yml): The driver-hash test added by the eMudhra
backport imports `yaml`, which is not in stdlib. Add `pyyaml==6.0.3
pathspec==0.12.1` to the pip install in the CI-tools unit test step, matching
what `main` does. Without this, `ci-nightly` would fail at test collection
with ModuleNotFoundError.

Finding 2 (coverage.yml): Integrate NVIDIA#3342 ("Fix Windows coverage test stack
overflows") onto this branch. Add a `stack-reserve` input to
setup-hardened-python; both Windows coverage jobs (build wheel + test wheel)
request 8 MiB, letting the action patch the base interpreter with `pefile`
and verify the reserve at runtime. Switch the Windows pytest steps from
`run_pytest_with_stack.py` to direct `python -m pytest`, since the patched
interpreter now provides a larger stack on the main thread and in child
processes. The old MSVC `editbin` step is implicitly replaced by the action.

Identified in review by rwgk.