[codex] PR 01 Forecast AoU safety guardrails

[JaeManP]

Summary

• Expand the public fork .gitignore to exclude nested checkpoints, model weights, outputs, W&B logs, credentials, vocabulary/tokenizer artifacts, and participant-derived tabular artifacts.
• Correct the mock-data tokenization command to include --use-mock-data.
• Make external logging fail closed: W&B is permitted only for explicitly declared synthetic/public runs outside an All of Us workspace.
• Add explicit synthetic/public-data opt-in for inference W&B usage.
• Avoid hard-coded fp16 defaults on non-CUDA machines for training and inference.
• Add pure-stdlib guardrail tests and a GitHub Actions workflow for Python 3.10 and 3.12.

Why

Review feedback found that the original PR was not truly fail-closed because W&B was allowed whenever WORKSPACE_CDR was absent. These changes deny external logging by default and allow it only for explicit synthetic/public-data runs.

Validation

• python3 -m unittest discover -s tests
• python3 -m compileall verily/forecast tests
• GitHub Actions Guardrails workflow passed for push and pull_request events.

Notes

Full mock-data execution still requires installing uv and Forecast dependencies.