Add golden store publish scripts + nightly CI wiring

[yuhuchua-qti]

Summary

Stacked on PR1 (migrate-clip-ut, #399). Delivers the producer side of the QNN EP unit-test golden pipeline: scripts that regenerate goldens, keep only accuracy-passing op groups, version-stamp them, and publish to Artifactory — plus the nightly CI job that runs it and the retention policy that prunes old archives.

Pure additive. No production op-builder / snapshot / accuracy source is touched. The consumer (per-PR accuracy-routing gate) is a separate later PR.

What's in it

Version resolver — single source of truth

• qcom/scripts/linux/resolve_tool_versions.sh — source-able and executable. Resolves QAIRT version (from sdk.yaml across QAIRT_SDK_ROOT/QNN_SDK_ROOT/SNPE_ROOT) and ORT runtime version (from $ORT_PREBUILT_ROOT/VERSION_NUMBER, then /VERSION). Deliberately does not read repo-root VERSION_NUMBER (that's the plugin/wheel version, not the ORT runtime). Undeterminable → exit 3 (graceful), so callers treat it as a safe signal. Writer and future gate stay consistent by sharing this code, never a process.

Publisher — thin orchestrator

• qcom/scripts/linux/publish_goldens.sh — regen goldens via run_snapshot_accuracy.sh --generate-goldens → read the accuracy report → package only groups whose every QnnUnit_Accuracy_<Group>Test case PASSED → write a version-stamped manifest.json → upload a write-once archive/<date>-<sha>/ and the mutable latest/ pointer. Default is dry-run; --publish is required to actually upload (it overwrites the shared latest/ pointer — never implicit).
• qcom/scripts/linux/filter_accuracy_pass_groups.py — extracted pass-group selection (a group passes iff all its accuracy cases COMPLETED with no failures).

Nightly CI wiring

• .github/workflows/qualcomm-internal-golden-publish.yml — reusable workflow (workflow_call + workflow_dispatch). Builds the coverage-instrumented binary, then runs publish_goldens.sh. dry_run defaults true so manual dispatch never clobbers the shared store; the scheduled producer opts into the real upload explicitly.
• .github/workflows/qualcomm-internal-release-nightly.yml — adds a golden-publish job (9am UTC cron) passing dry_run: false.
• qcom/build_and_test.py — new coverage_build_linux_x86_64 task (coverage build only, no HTML report — snapshot/accuracy tiers only compile under --enable-coverage).

Golden store layout + retention

• Store lives under qnn-ep-test-store/ut-snapshot/{archive,latest}/. The qnn-ep-test-store/ parent is shared with future siblings (e.g. modelzoo goldens).
• qcom/scripts/artifactory/aql/expired_golden_artifacts.json — AQL that matches qnn-ep-test-store/*/archive/* older than 10d. Retention keys off the archive/ segment only, so latest/ pointers (and any permanent data outside archive/) are never matched — retention can never leave a store without a current golden.
• .github/workflows/qualcomm-internal-clean-artifacts.yml — new "Delete old golden archives" step (runs on the existing daily cleanup cron, 1h before the publish cron).

Test plan

• pytest qcom/scripts/linux/tests — 17 tests pass (resolver priority order, sdk.yaml variants, undeterminable → exit 3).
• publish_goldens.sh dry-run end-to-end against a real coverage build-dir: regen → parse accuracy report → stage passing groups → build goldens.zip + manifest.json → prints the two jf rt upload commands without executing.
• manifest.json qairt_version/ort_version match resolve_tool_versions.sh both; git_sha matches git rev-parse --short=10 HEAD.
• Empty-pass guard: zero passing groups → die, no zip/upload.
• Live Artifactory upload verified via nightly (post-merge).

🤖 Generated with Claude Code