ci: release 1.28.0

[kibae]

Summary

• Sync onnxruntime-server with upstream ONNX Runtime 1.28.0.
• Bumps version strings via deploy/update-version.sh 1.27.1 -> 1.28.0.
• Accepts "layout" for session_options.graph_optimization_level, so ORT_ENABLE_LAYOUT is reachable.
• Sources the linux/arm64 runtime from the NuGet package, because upstream's 1.28.0 aarch64 release asset is broken.

Upstream 1.28.0 review

Checked the 1.28.0 release notes and diffed the 1.27.1 vs 1.28.0 headers for anything the server has to handle:

• Tensor element data types — ONNXTensorElementDataType is unchanged from 1.27.1. No new packed/sub-byte type to unpack; value_info.cpp already covers the full enum.
• OrtErrorCode — moved to a new onnxruntime_error_code.h and gained ORT_DEVICE_RESET. The server never inspects OrtErrorCode (it only catches Ort::Exception), so nothing to wire up. Recovering a cached session after a device reset would be a separate feature.
• Session options — 1.28.0 adds string config keys that mirror setters the server already exposes as typed fields (session.intra_op_num_threads, session.execution_mode, session.graph_optimization_level, …) plus session.name_based_layer_assignment. All are already reachable through the existing generic config_entries passthrough, so no new typed fields were added.
• GraphOptimizationLevel — parse_graph_opt_level was missing a string for ORT_ENABLE_LAYOUT (a pre-existing gap, not new in 1.28.0). Added "layout" with a unit test and the openapi enum entry.
• ONNX 1.22.0 / protobuf 6.33.5 — the repo pins no ONNX or opset version of its own, so there is nothing to sync.

Broken upstream aarch64 asset

ONNX Runtime 1.28.0 does not ship a usable Linux aarch64 archive. Where 1.27.1 published a 7 MB onnxruntime-linux-aarch64-1.27.1.tgz, 1.28.0 publishes a 350 KB onnxruntime-linux-aarch64.zip that contains only _manifest/spdx_2.2/ — no libraries, no headers, no nested archive. That SBOM's own file list names ./onnxruntime-linux-aarch64-1.28.0.tgz, so the packaging pipeline built the right artifact and the upload step published the manifest folder in its place.

download-onnxruntime.sh now falls back to the Microsoft.ML.OnnxRuntime nupkg for linux/aarch64, which ships the same CPU build under runtimes/linux-arm64 (verified: ELF aarch64, version string 1.28.0, header file set identical to the official tarball). The nupkg lays the library out flat as libonnxruntime.so while its SONAME is libonnxruntime.so.1, so the script recreates that link — the target stage only copies the directory and never runs ldconfig. The tgz branch takes over again as soon as upstream fixes the asset.

The script also used to fall through to wget/tar on an empty filename and exit 0 when no archive matched, surfacing the failure later as a confusing cmake error; a missing archive now fails it directly.

Test plan

• cmake build (Debug) and ctest pass locally against onnxruntime 1.28.0 GPU binary (9/9).
• download-onnxruntime.sh linux x64 (tgz) and linux aarch64 (nupkg fallback) both verified end to end into a sandboxed prefix.
• Cross-platform CI passes (Linux / Windows / macOS).
• Docker images built and pushed: linux-cpu (amd64+arm64), linux-cuda12, linux-cuda13.
• Update Docker Hub repository description after merge: https://hub.docker.com/repository/docker/kibaes/onnxruntime-server/general