fix(cargo-oxide): take the scaffold's host crates from cuda-host's git source

[alejandro-soto-franco]

What this adds

cargo oxide new wrote a manifest that took cuda-device and cuda-host from the repository's git URL but cuda-core (and cuda-async with --async) from crates.io 0.4.0. cuda-host depends on cuda-core by path inside that checkout, so every scaffolded project resolved two cuda-core packages and the code #[cuda_module] generates failed to type-check. The templates now name every CUDA crate from the same git source, so cargo resolves one copy of each.

Before:  cuda-host = { git = <repo> }   cuda-core = "0.4.0"
         Cargo.lock: cuda-core x2 (registry + git), cuda-bindings x2, cuda-core-derive x2
         error[E0308]: expected `cuda_core::simt::context::CudaContext`, found `CudaContext`
         7 errors sync, 13 errors async; nothing runs

After:   cuda-host = { git = <repo> }   cuda-core = { git = <repo> }   cuda-async = { git = <repo> }
         Cargo.lock: cuda-core x1, cuda-bindings x1, cuda-core-derive x1, all at one commit
         PASSED: all 1024 elements correct

#[cuda_module]
mod kernels {
    #[kernel]
    pub fn vecadd(a: &[f32], b: &[f32], mut c: DisjointSlice<f32>) { /* ... */ }
}
let module = unsafe { kernels::load(&ctx)? }; // generated code names cuda-host's CudaContext

What we fixed

• Both templates take cuda-core and cuda-async from GIT_REPO, the source cuda-host comes from; SHARED_HOST_CRATES_VERSION is gone.
• check-shared-crate-pin.sh section 3 requires git = "{GIT_REPO}" on every host-crate line in the templates and rejects a crates.io requirement there.
• New test scaffold_takes_every_cuda_crate_from_one_git_source asserts every cuda-* line in both templates names the same git source as cuda-device.
• The manifest comment and the status-guard step name that still described a crates.io scaffold now describe the git source.

Scaffold dependency contract

Every CUDA crate in a new project comes from one git source with no version requirement. The first build locks all of them to one commit of that repository, and cargo update moves them together. A crates.io cuda-core or cuda-async beside a git cuda-host is always a second crate and does not compile.

Implementation

• The regression began at bd6c3ce (a kernel which accepts a reference to an application struct seems to cause illegal memory access #29, 2026-10-01), which moved cuda-oxide from crates.io cuda-core 0.3.1 onto the git-root path copies while the scaffold kept its crates.io constant; build: depend on the shared host crates by path at tip of tree #1466 only dropped the version = "=0.4.0" qualifier. Lockfiles resolved at the commit before a kernel which accepts a reference to an application struct seems to cause illegal memory access #29 hold one cuda-core; at a kernel which accepts a reference to an application struct seems to cause illegal memory access #29, before build: depend on the shared host crates by path at tip of tree #1466 and at build: depend on the shared host crates by path at tip of tree #1466 they hold two.
• Cargo identifies a package by name, version and source. A path dependency declared inside a git-sourced crate resolves to that git source, and nothing unifies it with a registry copy, so the scaffold has to name cuda-core from the source cuda-host uses.
• This is the pre-Use the shared cutile-rs host crates in cuda-oxide #1102 form of the template minus cuda-bindings, which no user code names and which cuda-core pulls by path.
• The failures are identity mismatches on CudaContext, CudaModule, DeviceBuffer and the DriverError closure: 6 E0308 plus 1 E0277 in the sync template; 9 E0308, 3 E0277 and 1 E0599 in the async one.
• This supersedes the build: depend on the shared host crates by path at tip of tree #1466 plan to derive the scaffold's version from the root manifests: with no version in the template there is nothing to derive.

Verification

Checked at 180770a9:

• ✅ cargo test -p cargo-oxide --all-targets: 244 passed. With the old template lines restored and the new tests kept, 3 scaffold tests fail.
• ✅ cargo clippy -p cargo-oxide --all-targets -- -D warnings, cargo fmt --check and rustdoc with -D warnings clean.
• ✅ All 18 check-*.sh guards pass. check-shared-crate-pin.sh rejects four reintroduced forms (cuda-core = "0.4.0", { version = "0.4.0" }, a different git URL, cuda-async = "0.4.0") with exit 1.
• ✅ Baseline: main's cargo oxide new for both templates fails to build, 7 and 13 errors, with two cuda-core, cuda-bindings and cuda-core-derive per lockfile (and two cuda-async).
• ✅ Fix: cargo oxide new then cargo oxide run for both templates on an RTX 5090 (sm_120a, CUDA 13.4): PASSED: all 1024 elements correct, compute-sanitizer --tool memcheck 0 errors, one cuda-core per lockfile and zero registry cuda-* packages. Same result on the author's RTX 5060 Laptop (sm_120, CUDA 13.3).
• ✅ Merges cleanly with fix(cargo-oxide): scaffold and clone from NVIDIA/cuda-rust #1489 in either order; after both, every template line names https://github.com/NVIDIA/cuda-rust.git.

Caveats

• The test and guard compare the git URL only. A rev, branch or tag added to one line still resolves a second cuda-core, even at the same commit; a follow-up tightens the comparison to the full source.
• No CI job compiles a scaffolded project, which is how the broken template survived from 2026-10-01; a scaffold compile gate is a separate follow-up.
• The GPU runs used a cached backend; the standalone backend build from the scaffold's git checkout is unchanged by this PR and was not re-run here.
• GIT_REPO still names NVlabs/cuda-oxide, which GitHub redirects; fix(cargo-oxide): scaffold and clone from NVIDIA/cuda-rust #1489 renames it.

Closes #1459.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[nihalpasham]

/ok to test a536122

[nihalpasham]

I verified the breakage and the fix at a5361224 on the 5090 box:

• On main, a cargo oxide new project resolves two cuda_core crates (crates.io 0.4.0 and the git copy cuda-host pulls by path) and fails with the CudaContext type mismatches. With this change both templates compile and the lockfile has one cuda-core.
• I added one commit on top: two comments that still described the removed version constant (root manifest and the status-guard job). Nothing else changed.
• 244 cargo-oxide tests, clippy, fmt and all 18 guards pass. CI is green on this head.

Merges cleanly with #1489 in either order. Closes #1459: the scaffold no longer needs a version derived from the root manifests.