[Docker] Defer CUDA 13 NCCL override until after dependency resolution (#35756)

docker/Dockerfile

@@ -171,11 +171,6 @@ ARG CUDA_VERSION
 ARG BUILD_TYPE
 ARG SGL_KERNEL_VERSION
 ARG GITHUB_ARTIFACTORY
-# Renamed from NCCL_VERSION: the nvidia/cuda base image sets ENV NCCL_VERSION
-# (Debian apt format, e.g. 2.28.3-1), which shadows a same-named ARG inside RUN,
-# so the CUDA-13 nvidia-nccl-cu13 pip install below resolved an invalid PyPI
-# version. A distinct ARG name avoids the collision.
-ARG SGL_NCCL_VERSION
 
 WORKDIR /sgl-workspace
 
@@ -251,10 +246,6 @@ RUN --mount=type=cache,target=/root/.cache/pip \
            sed -i 's/nvidia-cutlass-dsl\[cu13\]/nvidia-cutlass-dsl/' pyproject.toml; \
        fi \
     && python3 -m pip install --extra-index-url https://download.pytorch.org/whl/cu${CUINDEX} ".[${BUILD_TYPE}]" \
-    && if [ "${CUDA_VERSION%%.*}" = "13" ]; then \
-           python3 -m pip install --force-reinstall --no-deps \
-               "nvidia-nccl-cu13==${SGL_NCCL_VERSION}"; \
-       fi \
     && if [ "${CUDA_VERSION%%.*}" = "12" ]; then \
            pip list --format=freeze | awk -F'==' '/-cu13(==|$)/ {print $1}' \
                | xargs -r python3 -m pip uninstall -y && \
@@ -417,6 +408,9 @@ ARG USE_LATEST_SGLANG
 ARG GITHUB_ARTIFACTORY
 ARG MOONCAKE_VERSION
 ARG MSCCLPP_VERSION
+# Renamed from NCCL_VERSION: the nvidia/cuda base image sets ENV NCCL_VERSION
+# (Debian apt format, e.g. 2.28.3-1), which shadows a same-named ARG inside RUN.
+ARG SGL_NCCL_VERSION
 
 WORKDIR /sgl-workspace
 
@@ -537,6 +531,15 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     termplotlib \
     "runai-model-streamer[s3,gcs,azure]>=0.15.7"
 
+# PyTorch 2.13 requires nvidia-nccl-cu13==2.29.7, so keep that version while
+# resolving dependencies and generating constraints.txt. DeepEP needs 2.30.7
+# at runtime; apply the override only after the constrained dependency solve.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    if [ "${CUDA_VERSION%%.*}" = "13" ]; then \
+        python3 -m pip install --force-reinstall --no-deps \
+            "nvidia-nccl-cu13==${SGL_NCCL_VERSION}"; \
+    fi
+
 # Per-CUDA-major package installs. The `nixl` stub package is needed (it owns
 # the `nixl` import path) but unconditionally requires nixl-cu12, so we install
 # it with --no-deps and pair it with the matching nixl-cu12 / nixl-cu13 binary