Unify CUDA 12.9 dependency environment

[xhd0728]

What changed

• keep all MCP servers in one shared .venv and uv.lock
• use the official PyTorch and vLLM CUDA 12.9 wheel indexes
• pin vLLM to the highest clean unified cu129 release
• constrain FastMCP, XGrammar, MinerU, and NumPy to tested compatible ranges
• move Docker GPU images to CUDA 12.9.1 and pin uv 0.12.0
• add CI validation for the unified all-extras environment and reject CUDA 13 runtime/compiler dependencies
• document the recommended single-environment install
• exclude local environments and runtime/test data from Docker build context

Root cause

Unrelated Dependabot lock updates re-resolved the unconstrained vllm>=0.22.1
requirement to a PyPI vLLM release whose metadata selected CUDA 13
kernel/compiler extras. This caused CUDA 13 packages to appear in otherwise
unrelated dependency PRs.

Validation

• uv lock --check
• uv sync --all-extras
• uv pip check
• CUDA 13 lock scan
• A800 GPU Torch CUDA 12.9 matmul
• vLLM cu129 import
• Faiss GPU index/search with NumPy 2.3.5
• UltraRAG sayhello build/run
• combined frontend lint, typecheck, and production build for Dependabot PRs chore(deps): bump postcss from 8.5.15 to 8.5.25 in /ui/frontend #476 and chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.17 in /ui/frontend #477