[jharlow-intel]

Description

Adds what Intel Python CI (gh-ci) needs from mkl_random: a ci/ directory and a new workflow, .github/workflows/intel-ci.yml. The workflow builds conda-recipe-cf for every platform and Python version the recipe declares, and tests each package in a clean conda-forge environment with ci/test.py. Intel's Jenkins then waits for that run, tests each package again on its own machines, scans it, and for a release tag publishes the packages it tested. Jenkins isn't switched on for mkl_random yet, so until it is, this only adds a GitHub Actions workflow.

• ci/matrix.py, ci/build.py, ci/hooks.py: the shared gh-ci scripts, standard library only. Here they look for conda-recipe-cf/ first and build Linux and Windows on GitHub-hosted runners. hooks.py installs the test requirements from ci/config.yml, the way Jenkins does.
• ci/test.py: runs pytest --pyargs mkl_random against the installed package and writes a JUnit report.
• ci/config.yml: the workflow, the artifact names (mkl_random {platform} Python {python}, as conda-package-cf.yml names them) and the test requirements, pytest.
• conda-recipe-cf/conda_build_config.yaml: now lists the Python versions, the ones conda-package-cf.yml builds today, for ci/matrix.py, and numpy: '2'. Without a NumPy variant, conda-build falls back to NumPy 1.26, which has no builds for Python 3.13 and newer. conda-package-cf.yml passes --python and --numpy itself, so it is unaffected.
• ci/README.md and AGENTS.md notes.

A pull request builds the two newest regular Python versions on Linux and Windows; pushes to master and tags build them all.

Miniforge is pinned to 26.7.2-0. Miniforge 26.9.4-0, released on 22 October, makes setup-miniconda's conda init fail on Windows runners, and the existing conda-package*.yml workflows, which install latest, hit it too on this pull request.

Overlap with #202. It also sets numpy: '2' in conda_build_config.yaml and drops Python 3.10, so whichever lands second needs a small rebase, and if 3.10 goes it should leave the python: list here too. conda-package-cf.yml and intel-ci.yml now both build conda-recipe-cf; retiring one can be a follow-up.

Verification

• Tests: this pull request's Intel Python CI run built Linux and Windows for Python 3.14 and 3.15 and ran ci/test.py against each package: 380 passed on Linux 3.14 and on Windows 3.15.
• Lint: pre-commit run on every changed file, all hooks passing, and zizmor on intel-ci.yml, no findings.
• python ci/matrix.py lists 14 builds, Linux and Windows for 3.10 to 3.15 and 3.14t; with --event pull_request it lists 3.14 and 3.15 on both.
• ci/config.yml loads with gh-ci's own parser.

Not verified

• The builds a tag or a push to the default branch adds, Python 3.10 to 3.13 and 3.14t; they use the same jobs.
• The Jenkins side, which isn't enabled for mkl_random yet.