Validate libtorch package architecture during binary validation (#8205)

## Problem

The libtorch branch of `validate_binaries.sh` only downloaded and
unzipped the package, then `exit 0` with no verification:

```bash
if [[ ${MATRIX_PACKAGE_TYPE} == "libtorch" ]]; then
    curl "${MATRIX_INSTALLATION}" -o libtorch.zip
    unzip libtorch.zip
    exit 0
fi
```

So the arch mismatch in pytorch/pytorch#187812 -- where the Windows
x86_64 libtorch package was overwritten by the arm64 build and shipped
Aarch64 binaries under the x64 download URL -- slipped through
validation entirely.

## Fix

After unzip, read the machine field directly from the extracted `c10`
library header (PE on Windows, ELF on Linux, Mach-O on macOS) and fail
validation if it doesn't match the runner architecture. This is shared
by the linux/windows/macos validate workflows, so all are covered.

- Dependency-free: uses the runner's `python` and parses the binary
header directly (no `file(1)`, which isn't reliably present on Windows
runners).
- Skips gracefully if the c10 library or python can't be found.

The upstream packaging fix is pytorch/pytorch#187837; this is the
validation-side guard so a future regression is caught before release
rather than by users.

## Test Plan

Verified header parsing against a real ELF binary and synthetic PE/ELF
headers with arm64 machine fields:

```
real /bin/ls on x86_64 host -> x86_64 (matches, passes)
synthetic AArch64 ELF (e_machine=0xB7) -> arm64 (mismatch on x64 runner, fails)
synthetic ARM64 PE (machine=0xAA64)    -> arm64 (mismatch on x64 runner, fails)
```

Confirmed the script still parses: `bash -n
.github/scripts/validate_binaries.sh`.

This change was authored with the assistance of an AI coding assistant
(Claude Code).

---------

Co-authored-by: Andrey Talman <atalman@users.noreply.github.com>

Author: atalman

.github/scripts/validate_binaries.sh

@@ -220,8 +220,14 @@ cleanup_conda_env() {
 handle_aarch64_cuda_override
 
 if [[ ${MATRIX_PACKAGE_TYPE} == "libtorch" ]]; then
-    curl "${MATRIX_INSTALLATION}" -o libtorch.zip
-    unzip libtorch.zip
+    LIBTORCH_PYTHON="python3"
+    if [[ ${TARGET_OS} == 'windows' ]]; then
+        # Windows runners only source conda.sh at this point without activating
+        # an env, so no python is on PATH yet. Activate base to get one.
+        conda activate base
+        LIBTORCH_PYTHON="python"
+    fi
+    "${LIBTORCH_PYTHON}" "${SCRIPT_DIR}/validate_libtorch.py" "${MATRIX_INSTALLATION}"
     exit 0
 fi
 

.github/scripts/validate_libtorch.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Download, extract, and validate a libtorch binary package.
+
+Validation loads the shipped c10 library with ctypes to confirm it is a
+working binary for the runner's platform and architecture. Loading a
+wrong-architecture library fails, so this catches a libtorch package being
+overwritten by a different-arch build on upload (see pytorch/pytorch#187812,
+where the Windows x86_64 package shipped Aarch64 binaries under the x64
+download URL).
+
+Usage: validate_libtorch.py <download-url>
+"""
+
+from __future__ import annotations
+
+import argparse
+import ctypes
+import glob
+import os
+import shutil
+import sys
+import urllib.request
+import zipfile
+
+
+def find_c10_lib() -> str | None:
+    for pattern in ("c10.dll", "libc10.so", "libc10.dylib"):
+        matches = glob.glob(os.path.join("libtorch", "lib", pattern))
+        if matches:
+            return matches[0]
+    return None
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "url",
+        nargs="?",
+        default=os.environ.get("MATRIX_INSTALLATION", ""),
+        help="libtorch package download URL",
+    )
+    args = parser.parse_args()
+    if not args.url:
+        sys.exit("ERROR: libtorch download URL not provided")
+
+    print(f"Downloading {args.url}")
+    # Set an explicit User-Agent: the R2-backed CDN behind download.pytorch.org
+    # returns 403 for the default "Python-urllib/x.y" agent.
+    request = urllib.request.Request(
+        args.url, headers={"User-Agent": "libtorch-validation"}
+    )
+    with urllib.request.urlopen(request) as response, open("libtorch.zip", "wb") as out:
+        shutil.copyfileobj(response, out)
+    with zipfile.ZipFile("libtorch.zip") as zf:
+        zf.extractall(".")
+
+    lib = find_c10_lib()
+    if lib is None:
+        sys.exit("ERROR: c10 library not found under libtorch/lib")
+
+    # On Windows c10 resolves its sibling DLLs from the package lib directory.
+    lib_dir = os.path.abspath(os.path.dirname(lib))
+    if sys.platform == "win32" and hasattr(os, "add_dll_directory"):
+        os.add_dll_directory(lib_dir)
+
+    print(f"Loading {lib} to validate it is a working binary for this runner")
+    ctypes.CDLL(lib)
+    print(f"Successfully loaded {lib}")
+
+
+if __name__ == "__main__":
+    main()