chore(deps): Update dependency intel/compute-runtime to v26.35.39758.10

[renovate]

Summary

Updates the development container's Intel NEO runtime from 26.31.39395.13 to 26.35.39758.10, deriving the matching gmmlib 22.10.0 and IGC 2.41.5 packages from Intel's release metadata and verifying every package against the published SHA-256 set.

The same branch closes the fetcher's fail-open and credential-transport defects: downloads are bounded, atomic, retry-aware, GitHub-host constrained, ambiguity-rejecting, checksum/package validated, and cleaned up on failure. Optional GitHub authentication now uses an ephemeral BuildKit secret across raw Docker, Compose, and CI instead of ARG GITHUB_TOKEN; anonymous builds remain supported.

Type

• feat — new feature
• fix — bug fix
• perf — performance improvement
• refactor — no behavior change
• docs — documentation only
• test — test-only
• build / ci — tooling / infra
• port — cherry-pick from upstream Netflix/vmaf
• sycl / cuda / simd — backend-specific

Checklist

• Commits follow Conventional Commits.
• make format && make lint is green locally — draft: complete pre-commit and pre-push suites are green; no native production source changed.
• Unit tests pass: meson test -C build — not applicable to the Python/container-only production delta; focused resolver and contract suites are green below.
• SIMD/GPU numerical diff — not applicable; runtime package selection changed, no scoring kernel changed.
• Feature-extractor twins — not applicable.
• New native source license header — no new C/C++/CUDA/HIP source.
• Breaking-change migration — not breaking.
• ADR-1271 has its index fragment/order row and generated ADR/MkDocs indexes are current.

Bug-status hygiene

• docs/state.md closes T-DEV-CONTAINER-GITHUB-TOKEN-BUILD-ARG-2026-09-20 against PR chore(deps): Update dependency intel/compute-runtime to v26.35.39758.10 #1468.

Netflix golden-data gate

• No Netflix assertAlmostEqual(...) score or golden assertion was modified.
• Golden-value exception requested — not applicable.

Cross-backend numerical results

Not applicable: no score arithmetic, models, fixtures, or dispatch code changed.

Deep-dive deliverables

• Research digest — docs/research/2070-intel-neo-fetch-fail-closed.md.
• Decision matrix — ADR-1271 ## Alternatives considered.
• AGENTS.md invariant note — dev/AGENTS.md and scripts/ci/AGENTS.md bind the secret/fetch/checker surfaces.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/changed/intel-neo-26-35.md and changelog.d/fixed/intel-neo-fetch-fail-closed.md.
• Rebase note — the ADR-1145 NEO matched-set section now preserves the fail-closed fetch and BuildKit-secret contracts.

Reproducer

python3 -m pytest -q dev/scripts/test_fetch_intel_neo.py
python3 -m unittest discover -s scripts/ci/tests -p test_dev_container_build_secret.py
env -u GITHUB_TOKEN docker build --check --file dev/Containerfile --target libvmaf-build .
env -u GITHUB_TOKEN docker compose --project-directory "$PWD" -f dev/docker-compose.yml config --quiet
docker buildx build --progress=plain --file dev/Containerfile --target gpu-sdks \
  --secret id=github_token,env=GITHUB_TOKEN .

Validation completed locally:

• resolver suite: 14 tests pass, including redirect credential stripping, retries, ambiguous/malformed assets, truncated output cleanup, checksum mismatch, Debian validation, and conflict-marker rejection;
• BuildKit-secret contract: 6 mutation tests pass; ARG/ENV, required secret, missing caller wiring, and missing anonymous documentation fail closed;
• Docker and Compose native --check: zero warnings;
• NEO 26.35 authenticated build: all five packages downloaded, matched to Intel's published hashes, validated, installed, and the gpu-sdks target completed;
• anonymous uncached request: GitHub's shared-IP rate limit caused a hard failure without leaving or installing a partial package, as intended;
• complete pre-commit and pre-push suites: green, including scoped mypy and strict MkDocs.

Known follow-ups

• This PR grants no upstream, vendor, or legacy-code warning exemption. The broader full-image warning inventory is actively owned by the warning-clean CUDA/dev-container sweep in chore(deps): Update nvidia/cuda Docker tag to v13.4.1 #1487 and FFmpeg refresh in fix(ai): restore ensemble registry license metadata + defer prod flip to one-shot retrain (ADR-1105) #902; chore(deps): Update dependency intel/compute-runtime to v26.35.39758.10 #1468 is the NEO matched-set and secure-fetch slice.
• Keep this PR draft until its refreshed exact-head hosted checks complete. The operator-held release PR chore(master): release 1.0.0-rc.1 #1213 is unrelated and must not be touched.

Breaking changes / migration

None. Anonymous builds continue to work when GitHub permits the request. Authenticated raw builds replace --build-arg GITHUB_TOKEN=... with --secret id=github_token,env=GITHUB_TOKEN; Compose maps the same optional host variable automatically.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.