docker: address review round 4 (jupyter probe, CPU messaging, llama EXDEV, %pip shim)

- docker-publish smoke + docker_confirm.sh probe Jupyter /login, not /api: the
  launcher always configures a password hash so /api returns 403 and curl -f
  would never flip the health flag (false build failure).
- entrypoint.sh CPU messaging: CPU mode covers Jupyter, GGUF tooling and
  llama.cpp (GGUF) Studio chat; training AND loading an Unsloth model
  (FastLanguageModel) still need a GPU, since from_pretrained runs CUDA probes.
- install_llama_prebuilt.py: rollback/activation moves used bare os.replace,
  which fails with EXDEV across overlayfs in a Docker build and fell back to a
  broken source build (no nvcc). Add is_cross_device_error + move_install_dir_aside
  (os.replace fast path, copy+remove on EXDEV; busy errors still re-raise).
- notebooks: %pip / %uv line magics and the `!python -m pip` form bypassed the
  PATH pip/uv shim and could overwrite the baked cu128 torch/vLLM stack. Add
  unsloth_nb_pip_magic.py to re-point them at the shim, wired via the IPython
  startup hook and installed into the venv site-packages.

docker/unsloth_ipython_startup.py

@@ -16,6 +16,13 @@ try:
     import unsloth_nb_compat
 
     unsloth_nb_compat.register_ipython()
+
+    # Re-point the %pip / %uv line magics and `!python -m pip` at the same shim,
+    # so the in-process / module install paths cannot bypass the PATH shim and
+    # overwrite the baked torch/vLLM stack. Independent of the sidecar hook.
+    import unsloth_nb_pip_magic
+
+    unsloth_nb_pip_magic.register_ipython()
 except Exception as _e:  # never break a kernel because of the helper
     import sys
     print(f"[unsloth-nb] startup hook skipped: {_e!r}", file = sys.stderr)