ci: run CPU validation on hosted runners

[SissiFeng]

Summary

• replace the no-op self-hosted unit-test job with real CPU pytest execution on ubuntu-latest
• discover tests from source/matterix_sm/test and source/matterix/test
• move the CPU-safe pre-commit check to a GitHub-hosted runner so it does not remain queued behind the GPU runner
• add read-only permissions, timeouts, concurrency cancellation, and manual dispatch

Validation

• python -m pytest -q -p no:cacheprovider source/matterix_sm/test source/matterix/test: 8 passed
• uvx pre-commit run --all-files: passed
• workflow YAML parsing and hosted-runner contract checks: passed
• git diff --check: passed

Evidence boundary

This PR adds a CPU unit-testing gate only. Isaac Lab, Isaac Sim, rendering, GPU runtime, and hardware behavior still require separate trusted-runner validation.