ops: add isolated ASR deployment and safe GPU test handoff

deployment/followup-audio-asr/build-image.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+cd "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+base=sha256:251eba5cc7c12fed0b75da22a9240e582b1c9e39f6fbc064f86781b963bd814f
+base_tag=local/qwen-asr-base:20261008-251eba5cc7c1
+actual=$(docker image inspect "$base" --format '{{.Id}}')
+[ "$actual" = "$base" ] || { echo 'Base image mismatch' >&2; exit 1; }
+docker tag "$base" "$base_tag"
+docker build --pull=false --build-arg BASE_IMAGE="$base_tag" -t local/qwen-asr:20261008 .
+docker image inspect local/qwen-asr:20261008 --format '{{.Id}}' > image-id.txt
+printf 'ASR_IMAGE='; cat image-id.txt
+# Explicitly no --gpus. This checks imports and signal processing only.
+docker run --rm --network none -e NVIDIA_VISIBLE_DEVICES=void --entrypoint python3 "$(cat image-id.txt)" /opt/qwen-asr/cpu_preflight.py