Torch 2.11's wheel metadata already pins the NVIDIA libs we were
force-reinstalling, and PR #21247 applied the same cleanup in
scripts/ci/cuda/ci_install_dependency.sh. Align the Dockerfile:

- nvidia-nccl-cu12/cu13==2.28.3: torch 2.11 ships 2.28.9 (pinning older
  was a silent downgrade)
- nvidia-cudnn-cu12==9.16.0.29: torch 2.11 ships 9.17.1.4 (downgrade)
- nvidia-cudnn-cu13==9.16.0.29: torch 2.11 ships 9.19.0.56 (downgrade)
- nvidia-cublas==13.1.0.3: already pulled transitively by
  cuda-toolkit[cublas]==13.0.2 at the exact same version
- nvidia-cutlass-dsl==4.4.2 force-reinstall: already pinned in
  python/pyproject.toml and resolved by the main sglang dep install

Also fix a nixl duplication bug on cu13 images: the `nixl` stub package
has an unconditional requires_dist on nixl-cu12>=1.0.1, so installing
plain `nixl` in the essential-packages block pulled nixl-cu12 (~49 MB)
onto cu13 images on top of the subsequent nixl-cu13 install. Install
nixl-cu12 / nixl-cu13 directly in the per-CUDA-major block instead.

Validator (docker/validate_image.py): drop the nvidia-cublas hard-pin
assertion; it's now transitively pinned by torch and the Dockerfile no
longer force-reinstalls it. The torch-internal cross-check for cudnn
and nccl still runs and will assert against whatever torch 2.11 ships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Correct Dockerfile comment pointer: validator is invoked from
  _docker-build-and-publish.yml, not release-docker-dev.yml
- Drop ~49 MB magnitude from nixl comment (rot-prone, not load-bearing)
- Add nixl smoke import to validator (this area was just restructured
  and otherwise unasserted)
- Convert PackageNotFoundError to AssertionError in the torch-bundled
  cudnn/nccl cross-checks so a missing dep produces a clean FAIL line
  instead of a raw traceback
- Retry docker pull in the 4 validation steps: DockerHub has brief
  eventual-consistency after push-by-digest

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Removes docker/validate_image.py and the four "Validate ..." steps from
.github/workflows/_docker-build-and-publish.yml. The remaining changes
(cu129 torch resolution fix, NVIDIA override cleanup, nixl per-CUDA install)
stand on their own; the validator can ship in a follow-up PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…u13 refs

Address findings from the code review:

1. release-docker.yml: tag_config JSON was malformed (missing comma after
   cu130 entry, trailing comma after cu129). fromJson would fail and break
   every tag-pushed release. Header comment also said latest-cu139.

2. docker/Dockerfile: restore the cu12 --index-url torch pre-install that
   the prior 'upd' commit dropped. With #21247 landed, torch 2.11 is the
   PyPI default at cu130, and --extra-index-url alone won't override it
   when both indexes publish the same version — cu126/cu128/cu129 images
   would silently ship cu130 torch.

3. Update consumers of the dropped dev-cu13 / latest-cu130-runtime tags
   to the new naming (dev = cu13, dev-cu12 = cu12): trivy-scan-dev.yml,
   nightly-72-gpu-gb200.yml, release-docker-dev.yml description,
   _docker-cleanup-nightly.yml examples, and
   scripts/ci/utils/docker_build_metadata_args.py MOVING_TAGS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…or smooth transition

Apply follow-ups from the review of PR #23593:

(a) release-docker.yml: publish v{ver}-cu130 and latest-cu130 as aliases
    on the cu130 framework release. Mirrors the runtime aliases added in
    the prior commit. Without this, B200/B300 consumers pinned to
    `lmsysorg/sglang:v0.5.X-cu130` would break on the next release.

(b) release-docker-dev.yml: add nightly-dev-cu13-{date}-{short_sha} to the
    cu130 nightly tag list so the immutable history tag keeps being
    published under the pre-flip name. select_tag still picks the
    canonical nightly-dev-{date}-{short_sha} as the build-arg image tag
    (dev-cu13 is in MOVING_TAGS, so it's skipped).

(c) release-docker-dev.yml: add nightly-dev-cu13 to the cleanup-nightly
    tag_prefixes so the historical cu13 tags get GC'd alongside the new
    nightly-dev / nightly-dev-cu12 prefixes.

Note: the cu12-default → cu13-default flip on `dev`, `latest`, `v{ver}`,
`latest-runtime`, and `v{ver}-runtime` is the unavoidable breaking change
in this PR — those tags move by definition and have no clean alias fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…add-apt-repository"

This reverts commit 128078f.

The base and runtime stages both ran `add-apt-repository ppa:deadsnakes/ppa`
to pull Python 3.10 and Python 3.12. Ubuntu 24.04 (noble) already ships
python3.12 in `main`, and nothing in the image actually consumes Python
3.10 beyond an unused `update-alternatives` slot. Removing the PPA call
avoids transient Launchpad 504s during `add-apt-repository`, which has
broken the dev-image build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>