docker: address review round 4 (jupyter probe, CPU messaging, llama EXDEV, %pip shim)

- docker-publish smoke + docker_confirm.sh probe Jupyter /login, not /api: the
  launcher always configures a password hash so /api returns 403 and curl -f
  would never flip the health flag (false build failure).
- entrypoint.sh CPU messaging: CPU mode covers Jupyter, GGUF tooling and
  llama.cpp (GGUF) Studio chat; training AND loading an Unsloth model
  (FastLanguageModel) still need a GPU, since from_pretrained runs CUDA probes.
- install_llama_prebuilt.py: rollback/activation moves used bare os.replace,
  which fails with EXDEV across overlayfs in a Docker build and fell back to a
  broken source build (no nvcc). Add is_cross_device_error + move_install_dir_aside
  (os.replace fast path, copy+remove on EXDEV; busy errors still re-raise).
- notebooks: %pip / %uv line magics and the `!python -m pip` form bypassed the
  PATH pip/uv shim and could overwrite the baked cu128 torch/vLLM stack. Add
  unsloth_nb_pip_magic.py to re-point them at the shim, wired via the IPython
  startup hook and installed into the venv site-packages.

.github/workflows/docker-publish.yml

@@ -576,12 +576,15 @@ jobs:
           ok_studio=0; ok_jupyter=0
           for i in $(seq 1 60); do
               if curl -fsS http://localhost:18000/api/health >/dev/null 2>&1; then ok_studio=1;  fi
-              if curl -fsS http://localhost:18888/api        >/dev/null 2>&1; then ok_jupyter=1; fi
+              # Probe /login, not /api: the launcher always sets a Jupyter password
+              # hash, so /api returns 403 (curl -f would never flip ok_jupyter).
+              # /login is the unauthenticated page and 200s once the server is up.
+              if curl -fsS http://localhost:18888/login      >/dev/null 2>&1; then ok_jupyter=1; fi
               [ "$ok_studio" = 1 ] && [ "$ok_jupyter" = 1 ] && break
               sleep 5
           done
           [ "$ok_studio"  = 1 ] || { echo "Studio /api/health never went healthy"; exit 1; }
-          [ "$ok_jupyter" = 1 ] || { echo "Jupyter /api never responded"; exit 1; }
+          [ "$ok_jupyter" = 1 ] || { echo "Jupyter /login never responded"; exit 1; }
           echo "Studio + Jupyter healthy"
         env:
           STEPS_META_STUDIO_JSON: ${{ steps.meta_studio.outputs.json }}