Add CPU emergency lane (ci-self-cpu) with /run-cpu admin button

.github/workflows/ci-self-cpu-button.yml

@@ -0,0 +1,65 @@
+name: CI Self CPU Button
+
+# PR comment command: a repo admin comments "/run-cpu" on a pull request and
+# this calls ci-self-cpu.yml (workflow_call) to validate that PR's head on the
+# cpu + NPU runners — the emergency lane for GitHub-hosted congestion.
+#
+# Gate: permission(commenter) == 'admin' ONLY (getCollaboratorPermissionLevel).
+# Note: issue_comment from fork PRs runs with a read-only GITHUB_TOKEN; the
+# permission check is a read API and must be verified working on a fork PR.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  gate-and-resolve:
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/run-cpu')
+    runs-on: [self-hosted, cpu]
+    outputs:
+      repository: ${{ steps.resolve.outputs.repository }}
+      ref: ${{ steps.resolve.outputs.ref }}
+      pr_number: ${{ steps.resolve.outputs.pr_number }}
+    steps:
+      - name: Admin-only gate
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const user = context.payload.comment.user.login;
+            let perm = null;
+            try {
+              const r = await github.rest.repos.getCollaboratorPermissionLevel(
+                { ...context.repo, username: user });
+              perm = r.data.permission;
+            } catch (e) {
+              core.info(`not a repo collaborator: ${user}`);
+            }
+            if (perm !== 'admin') {
+              core.setFailed(
+                `denied: ${user} has ${perm || 'no'} repo permission; ` +
+                `admin required to trigger /run-cpu`);
+            }
+      - name: Resolve PR head
+        id: resolve
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = await github.rest.pulls.get({
+              ...context.repo,
+              pull_number: context.payload.issue.number,
+            });
+            core.setOutput('repository', pr.data.head.repo.full_name);
+            core.setOutput('ref', pr.data.head.sha);
+            core.setOutput('pr_number', String(pr.data.number));
+
+  lane:
+    needs: [gate-and-resolve]
+    uses: ./.github/workflows/ci-self-cpu.yml
+    with:
+      repository: ${{ needs.gate-and-resolve.outputs.repository }}
+      ref: ${{ needs.gate-and-resolve.outputs.ref }}
+      pr_number: ${{ needs.gate-and-resolve.outputs.pr_number }}