Drops the unverified "NaNs on every AMD GPU" phrasing and the single-PR
attribution from the test's comments and assertion message. The floor
itself is unchanged.
security-audit.yml builds its hf-stack scan set by indexing
[huggingfacenotorch] out of pyproject.toml with no guard. The pip release
branch never had that extra, so advisory audit and the three pip
scan-packages jobs died on a bare KeyError from at least 2026-07-08 to
2026-07-27 without anyone reading it as a missing extra.
Add a contract test for both extras (existence, torch-free, bnb floor
excludes the NaN-at-decode range) plus a check that every extra the
workflow indexes actually exists, and give the workflow a message that
names the problem instead of a raw traceback.
