fix(pii): assert torch CUDA state after every pip install

The check sat directly after the torch install, but requirements-gliner.txt
and requirements-dev.txt are installed afterwards and resolve against PyPI
with no torch pin, so a future gliner bump could swap the wheel that
torch_index selected without tripping the assert.

Neither file changes torch today (verified: torch is 2.11.0+cu128 both before
and after the gliner install), so this guards the invariant rather than fixing
a live regression. Moving it below the last pip install makes it certify the
torch that actually ships.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QHNEWVrh7k89m8Wtqzhs18

Author: TheodoreSpeaks

docker/pii.Dockerfile

@@ -67,13 +67,6 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     esac && \
     pip install torch==${TORCH_VERSION} --index-url "${torch_index}"
 
-# A CPU-only wheel on amd64 silently degrades to the "torch.cuda.is_available()
-# is False" crash only once GLiNER loads on a GPU host, so assert at build time.
-RUN python -c "import torch; \
-have = torch.version.cuda is not None; \
-want = '${TARGETARCH}' == 'amd64'; \
-assert have == want, f'{torch.__version__}: cuda build={have}, expected={want}'"
-
 COPY apps/pii/requirements-gliner.txt ./requirements-gliner.txt
 RUN --mount=type=cache,target=/root/.cache/pip \
     pip install -r requirements-gliner.txt
@@ -106,6 +99,15 @@ COPY apps/pii/requirements-dev.txt ./requirements-dev.txt
 RUN --mount=type=cache,target=/root/.cache/pip \
     pip install -r requirements-dev.txt
 
+# Runs after every pip install, because the requirements above resolve against
+# PyPI and could swap the wheel torch_index chose. A cpu-only torch on amd64
+# otherwise surfaces only as "torch.cuda.is_available() is False" once GLiNER
+# loads on a GPU host.
+RUN python -c "import torch; \
+have = torch.version.cuda is not None; \
+want = '${TARGETARCH}' == 'amd64'; \
+assert have == want, f'{torch.__version__}: cuda build={have}, expected={want}'"
+
 RUN groupadd -g 1001 pii && \
     useradd -u 1001 -g pii pii && \
     chown -R pii:pii /app