ci: canonicalize and merge-gate pixi lockfiles

[rwgk]

Description

Related to #2804. Follow-up to #2780.

Operational testing found that Pixi 0.73.0 has two command paths that disagree
about the byte-canonical representation of the same resolved lockfile:
pixi update --no-install writes one form, while pixi lock --check exits
successfully but rewrites it to another. This made an automatically generated
refresh PR fail the freshness check intended to validate it. The complete
reproduction and evidence are in this issue comment.

This PR keeps Pixi pinned at 0.73.0 and:

• canonicalizes each automated refresh with pixi lock --check, then verifies
  that a second check leaves the lockfile byte-identical;
• makes freshness failures directly actionable by linking to the
  manual refresh workflow;
• exposes one stable Pixi lockfile freshness gate while retaining the
  per-workspace diagnostic jobs;
• provides the maintainer-applied ci-pixi-lockfile-override label as an
  explicit emergency escape hatch; and
• canonicalizes the current benchmarks/cuda_core/pixi.lock baseline without
  changing resolved package versions.

The aggregate gate runs on every pull request, so making it required cannot
leave path-unrelated PRs waiting for a check that was filtered out. An override
changes only the aggregate decision: failed workspace diagnostics remain
visible. Override approval is tied to the current PR head; opening, reopening,
or pushing a new head removes or invalidates the label.

After this merges, repository configuration will require
Pixi lockfile freshness gate for pull requests targeting main. This will use
a separate main-only ruleset so maintenance branches that do not contain the
workflow are unaffected.

Review focus

• The workaround deliberately preserves the Pixi 0.73.0 pin and proves that
  refresh output reaches a byte-stable fixed point.
• The required status has one stable name; matrix job names remain diagnostic
  only.
• The override is explicit and visible, cannot mask discovery or cancelled
  jobs, and is invalidated for a new PR head.

Validation

• Official Pixi 0.73.0 canonicalized the current benchmark lock to Git blob
  6aea1414...; a second check was byte-identical and no resolved package
  versions changed.
• pixi lock --check with Pixi 0.73.0 passed for all six workspaces with no
  lockfile byte diff.
• pre-commit run --all-files passed, including actionlint, YAML validation,
  link checking, typing, and secret scanning.
• Current head 0ab2584 completed with 134 passing checks, five intentional
  skips, and no pending or failed checks. The
  Pixi freshness run
  passed discovery, all six workspace diagnostics, and the stable gate; the
  full CI run
  passed its complete cross-platform matrix.
• The base-controlled override-reset workflow cannot receive its first live
  pull_request_target event until it is present on the default branch; its
  event scope, permissions, shell logic, and YAML were validated locally.

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[rwgk]

/ok to test 0ab2584

[github-actions]

Doc Preview CI
🚀 View preview at https://nvidia.github.io/cuda-python/pr-preview/pr-2841/
https://nvidia.github.io/cuda-python/pr-preview/pr-2841/cuda-core/
https://nvidia.github.io/cuda-python/pr-preview/pr-2841/cuda-bindings/
https://nvidia.github.io/cuda-python/pr-preview/pr-2841/cuda-pathfinder/
Preview will be ready when the GitHub Pages deployment is complete.