[no-ci] CI: remove restricted paths guard

[rwgk]

Description

Remove the obsolete CI: Restricted Paths Guard workflow now that CUDA Python is being relicensed under Apache-2.0.

The guard existed to label external PRs that touched cuda_bindings/ or cuda_python/ for special review while those paths had license-specific contribution restrictions. With the relicensing work in PR #2285 and PR #2293, that path-specific automation is no longer needed.

(I also checked for non-obvious references before removing the workflow. Tracked repository files no longer reference CI: Restricted Paths Guard, restricted-paths-guard, or Needs-Restricted-Paths-Review, and the GitHub ruleset/branch-rule metadata I inspected did not show any required-check reference to the guard.)

Follow-up

• Remove the Needs-Restricted-Paths-Review label from the repository after this workflow removal lands.

[leofang]

@kkraus14 raised the concern that even with re-licensing we still don't want users to touch the generated code (because we need to update the codegen first). @kkraus14 @mdboom, we need to a new practice that can still be automated. Code review can be conducted by anyone on the team, and we've seen human errors before (that led to this path guard).

[leofang]

(see above, blocking merge until we have a conclusion.)

[rwgk]

@kkraus14 raised the concern that even with re-licensing we still don't want users to touch the generated code (because we need to update the codegen first). @kkraus14 @mdboom, we need to a new practice that can still be automated. Code review can be conducted by anyone on the team, and we've seen human errors before (that led to this path guard).

I think it's a great idea to have a "generated files guard", but I think we should start such a workflow from scratch. E.g. it doesn't need any of the "is NVIDIA employee" logic, which is what made the restricted paths guard workflow so complex. The "generated files guard" workflow should be developed in tandem with cybind tweaks: small changes in cybind that make the guard workflow easier to implement (@mdboom for visibility). — I'm interested in working on that: if done right, it'll make the cuda-python-private workflows easier, too, potentially much easier.

[leofang]

but I think we should start such a workflow from scratch. E.g. it doesn't need any of the "is NVIDIA employee" logic

I think we do mean that we don't want non-NVIDIANs to touch these files.

[rwgk]

but I think we should start such a workflow from scratch. E.g. it doesn't need any of the "is NVIDIA employee" logic

I think we do mean that we don't want non-NVIDIANs to touch these files.

Oh, I didn't explain:

Because determining "is NVIDIA employee" is troublesome/unreliable, I was thinking of adding a (simple) heuristic: does it look like cybind was run?

So if someone only changes one, or a small subset, of the generated files, the alarm would trigger.

It seems very unlikely to me that anyone would change all generated files not through cybind.