Purpose

Bumps the GPU inference runtime to the vLLM 0.24 release line and updates vLLM-Omni now that the 0.24.0 wheel is available on PyPI. The vLLM Linux x86_64 GPU worker path intentionally keeps the upstream CUDA 12.9 release wheel because the PyPI wheel targets CUDA 13.

Changes

• pyproject.toml — pins vllm==0.24.0 and vllm-omni==0.24.0 in the GPU inference extra.
• pyproject.toml / uv.lock — keeps the Linux x86_64 vllm source override on the official v0.24.0 +cu129 release wheel so CUDA 12.9 workers stay compatible; other platforms resolve the PyPI vllm==0.24.0 package.
• uv.lock — resolves vllm-omni==0.24.0 from the PyPI vllm_omni-0.24.0-py3-none-any.whl artifact.
• src/worker/requirements/requirements.gpu.txt — regenerates the worker GPU requirements with the vllm CUDA 12.9 wheel marker and the plain vllm-omni==0.24.0 pin.
• .github/workflows/security.yml, docs/CODE_STYLE.md — document why the GPU audit remains non-strict for the non-PyPI vllm +cu129 wheel and flashinfer-jit-cache.

Test Plan

• uv lock --check
• uv run scripts/dev/sync_requirements.py
• uv run pytest tests/worker/test_vllm_template_schema.py tests/worker/test_vllm_lora_executor.py tests/worker/test_vllm_scoped_plugins.py tests/worker/test_omni_executor_inheritance.py tests/worker/test_model_loading_params.py tests/shared/test_inference_spec.py tests/server/task/test_parser.py -q — 114 passed, 3 warnings

Not run: e2e tests or image builds.