build: make megatron_core wheel byte-reproducible

[zrr1999]

Problem

The daily-cron wheel megatron_core-0.19.0+<commit> published to paddle-github-action.bj.bcebos.com/whl/ has a churning sha256 even though it is built from the same commit (observed e908877f → 2bf28206 → 7a6132f0). Because the artifact URL is fixed and overwritten by every nightly rebuild, any downstream consumer that pins it with pip install --require-hashes breaks intermittently. This took down PaddleFleet's GLM-5.2 accuracy-alignment CI (the reference setup_reference.sh aborted on a megatron_core hash mismatch before training).

Root cause (non-reproducible build)

1. scripts/dependence/build.sh (megatron_build) runs python -m build --wheel with no SOURCE_DATE_EPOCH, so every rebuild stamps the current wall-clock time into every regenerated zip member (the compiled .so and *.dist-info/RECORD) → different bytes → different sha256.
2. setup.py builds the megatron.core.datasets.helpers_cpp Pybind11Extension with only -O3 -Wall -std=c++17 — no deterministic compile/link flags, so the .so can vary (random ELF build-id, embedded build paths).

Fix

• build.sh: pin SOURCE_DATE_EPOCH to the source commit time (with a fixed fallback for tarball builds) and export deterministic CFLAGS/CXXFLAGS/LDFLAGS (-ffile-prefix-map, -frandom-seed, -g0, -Wl,--build-id=none).
• setup.py: add matching extra_compile_args + extra_link_args=[-Wl,--build-id=none, -Wl,-s] so the .so is deterministic even when built directly.

Verification

Built the wheel twice with a full clean in between:

• With the fix: identical sha256 089434eb… (MATCH ✅)
• Without the fix (pristine): f8b260e1… vs 6a7bdf95… (DIFFER)

Note

Reproducibility holds for a fixed toolchain (g++/GNU-ld/Python ABI, cp312 linux_x86_64). A CI base-image compiler bump will legitimately move the digest once. Downstream consumers should still prefer immutable, uniquely-named artifacts; a complementary follow-up is to publish per-build immutable object keys rather than overwriting the fixed URL.

[morirun]

初看（Draft，head 286b64e）

方向对：把 SOURCE_DATE_EPOCH 与确定性 C/C++/链接参数钉住，正好对上下游 --require-hashes 被 nightly 重打包打穿的问题（和 PaddleFleet 侧对齐 CI 的现象一致）。双次干净构建同 sha256 的验证也写清楚了。

小点

1. setup.py 的 -ffile-prefix-map=.=.
   走 build.sh 时主要靠导出的 CFLAGS/CXXFLAGS（已用 ${megatron_dir}=.），这条直接编译路径上的 map 基本是空操作，绝对构建路径仍可能进 .so。若希望「不经过 build.sh 也稳定」，可改成与 build.sh 同类的真实前缀映射，或在注释里写明「直接 setup.py 构建不保证与 nightly 同 digest」。

2. -Wl,--build-id=none / -Wl,-s
   GNU ld 场景合理；若以后同脚本在 macOS/非 GNU 链接器上编 helpers，这些 flag 可能告警或无效。当前若只发 linux_x86_64 wheel，可以接受，建议在 PR 里写死目标平台假设。

3. 后续制品策略（PR Note 已提到）
   可复现构建能稳住 digest；若 BOS 仍覆盖同一 URL，下游长期仍脆弱。不可变对象键是更好的下一刀，本 PR 不必一起做。

不代推、不代合；Draft 阶段仅作核对。