Update to hdf5 2.1.0, other GMAO updates

[mathomp4]

NOTE

This will be split into four PRs. Three for the package updates, and then this one can merge/rebase into just GMAO changes.

---

Description

Version updates (configs/common/packages.yaml)

• hdf5 1.14.5 to 2.1.0.
• ecbuild 3.12.0 to 3.15.2. (To fix annoying CMake 4.4+ deprecation warning)
• fms: allow @=2026.01.01 (used in GEOS pioneer testing). Precision is precision=32,64 for @:2025.03 and precision=mixed for @2025.04:.
• nccmp accepts 1.11.0.0 or 1.9.0.1. 1.11.0.0 is preferred, so 1.9.0.1 must be requested explicitly. (I know some system required it still?)
• parallel-netcdf 1.12.3 to 1.14.1. It fixes a GCC 15 build failure, and the shared-intel workaround in packages_oneapi.yaml is removed because it only applied to 1.12.3.
• py-torch requires @2.10: and ~kineto. PyTorch 2.12 ignores USE_XPU=OFF when built through PEP 517, so with oneAPI Kineto enables its XPU/PTI plugin and the oneAPI toolkit lacks the PTI CMake files. Re-enable once that is fixed.

Cargo home

• CARGO_HOME becomes SPACK_CARGO_HOME in util/epic/batch_install.sh, util/fetch_cargo_deps.py, util/install_rust.sh and WCOSS2's setup.sh. install_rust.sh no longer overwrites PATH. fetch_cargo_deps.py runs cargo fetch only in the top-level source directory, which fixes py-cryptography failures.
• Heads-up for users: anyone who sets CARGO_HOME for the fetch step now needs SPACK_CARGO_HOME.

spack-stack packages (repos/spack_stack)

• geos-gcm-env: new versions 12.1.0 and 11.10.0, new fms, cdo and grads variants, and more Python and utility run dependencies.
• ioda, oops: new trust_ecbuild_flags variant that sets ECBUILD_TRUST_FLAGS, to skip compiler-flag probes that always hit me at NAS and Discover with oneapi
• ai-env: fix a malformed git URL.

NASA Templates

Also a lot of changes to NASA systems I maintain. But that's for me.

Dependencies

• waiting on Updates from GMAO macOS Testing spack-packages#92

Issues addressed

Closes #1822
Closes #2056 (sort of, ai-env is not installed by default)

It also touches on #1882 (for rust stuff) and maybe #2016 is now closable?

Applications affected

Anything using HDF5, mainly via the version bumps above. GEOS-specific templates and the new geos-gcm-env versions.

Systems affected

All NASA systems directly. Other systems pick up the HDF5 2.1.0, ecbuild, parallel-netcdf and py-torch version changes from the common config. Site-specific changes are limited to GMAO, Discover, NAS and the new bucy site, plus the SPACK_CARGO_HOME rename on WCOSS2 and EPIC.

Testing

• CI: Note whether the automatic tests (GitHub actions tests that run automatically for every commit) pass or not
  • GitHub actions CI tests pass
  • GitHub actions CI tests do not pass (provide explanation)
  • GitHub actions CI tests skipped (provide explanation if necessary)
• New tests added: List and describe any new tests added to GitHub actions
  • ...
• Additional testing: Add information on any additional tests conducted
  • ...

Checklist

• This PR addresses one issue/problem/enhancement or has a very good reason for not doing so.
• These changes have been tested on the affected systems and applications.
• All dependency PRs/issues have been resolved and this PR can be merged.
• All necessary updates to the documentation (spack-stack wiki) will be made when this PR is merged

[mathomp4]

Note to @climbfuji et al. I made this PR mainly because I don't want to lose everything.

I can also do cherry-picks of all the configs/common changes if desired.

That'd be...7 PRs, I think:

1. hdf5
2. ecbuild
3. fms
4. nccmp
5. parallel-netcdf
6. py-torch
7. Cargo

[climbfuji]

Note to @climbfuji et al. I made this PR mainly because I don't want to lose everything.

I can also do cherry-picks of all the configs/common changes if desired.

That'd be...7 PRs, I think:

1. hdf5
2. ecbuild
3. fms
4. nccmp
5. parallel-netcdf
6. py-torch
7. Cargo

I agree with the idea of breaking up things, but I don't want to create too much extra work. I'd be glad to help picking things apart (git checkout matt/gmao/updates-2026Sep22 -- /path/to/file1 etc). We could combine packages that fit together, for example (1) hdf5+parallel-netcdf for I/O; (2) ecbuild+fms+nccmp; (3) cargo+py-torch; (4) gmao-specific updates. If we do (1)-(3) first, then updating this PR should result in (4) = gmao-specific updates only?

[mathomp4]

I'm going to close this in favor of the separate PRs incoming. I'll re-open when those are in.