Pin ExecuTorch to the release/1.4 branch head

[shoumikhin]

Summary

main currently pins the ExecuTorch dependency to the release/1.3 branch head
(6118688a). That commit predates the shared extension_cuda caller-stream work
in ExecuTorch, so a native build against it does not have a single shared
caller-stream instance across CUDA-capable delegates.

This change bumps the pin to the release/1.4 branch head
(cd380e7aefd18c171271cc228d3a155455095219). release/1.4 is the first
ExecuTorch release line that contains both required PRs:

• Make the CUDA caller-stream guard a shared extension/cuda library (#20158) executorch#20158 (shared extension_cuda caller-stream library)
• Use caller CUDA stream for D2H and H2D copies (#20498) executorch#20498 (caller CUDA stream for H2D/D2H copies)

The bump follows the existing convention in this repo of pinning a release-branch
head commit (the new_git_repository rule takes a commit, not a branch name),
mirroring the current release/1.3 wording.

Precedent (verified against upstream history)

The release/1.3 pin was introduced in PR #4285 (commit a7e1d58abd48,
2026-05-26), which converted the ExecuTorch dependency from an
env-detected local_executorch rule to a pinned new_git_repository. That
commit:

• Touched exactly these four Bazel files and no others in the pin set:
  MODULE.bazel, docker/MODULE.bazel.docker, docker/MODULE.bazel.ngc,
  toolchains/ci_workspaces/MODULE.bazel.tmpl.
• Added byte-identical pin wording to each
  (# Pinned to the ExecuTorch release/1.3 branch head. /
  # latest commit in release/1.3 branch / commit = "6118688a…").
• Did not touch examples/executorch_reference_runner/README.md.

This PR mirrors that exactly: same four files, same wording (with 1.3 -> 1.4
and the new SHA), README untouched. One difference in kind: #4285 established the
pin as part of a broader build-cleanup PR, whereas this is a standalone
one-line-per-file SHA + comment bump. The pin value has not been changed since
#4285, so there is no prior pure-bump commit to copy; #4285 is the file-set and
wording precedent.

Motivation

This is a general, independently useful upgrade: main should track the current
ExecuTorch release line, and 1.4 is now branch-cut. It also unblocks the
ExecuTorch TensorRT backend work (PR #4421), which needs the two caller-stream
PRs above and therefore cannot build against the 1.3 pin.

What changed

Four Bazel files are updated, one pin each:

• MODULE.bazel
• docker/MODULE.bazel.docker
• docker/MODULE.bazel.ngc
• toolchains/ci_workspaces/MODULE.bazel.tmpl

Each edit is the same:

-# Pinned to the ExecuTorch release/1.3 branch head.
+# Pinned to the ExecuTorch release/1.4 branch head.
 new_git_repository(
     name = "executorch",
     build_file = "@//third_party/executorch:BUILD",
-    # latest commit in release/1.3 branch
-    commit = "6118688a095fd9697224f5cad72ce42db641c9cd",
+    # latest commit in release/1.4 branch
+    commit = "cd380e7aefd18c171271cc228d3a155455095219",

The reference-runner guide (examples/executorch_reference_runner/README.md)
defaults EXECUTORCH_REF to main and is intentionally left unchanged.

Follow-up

release/1.4 does not yet have an immutable v1.4.0 tag. Swap the branch-head
commit for the v1.4.0 tag commit once ExecuTorch publishes it. Same edit
sites, one SHA change per file plus the comment tweak from "release/1.4 branch
head" to the tag.

Test plan

• Verified both required PRs are contained in the new pin: the merge commits of
  Make the CUDA caller-stream guard a shared extension/cuda library (#20158) executorch#20158 and #20498 are both ancestors of the release/1.4
  head cd380e7a.
• CI, specifically executorch-static-build, builds //:libtorchtrt and runs
  .github/scripts/verify-executorch-reference-runner.sh against the new pin;
  it must stay green.
• Pre-existing unrelated red suites on main (L2 dynamo/torch-compile, JetPack
  wheel, RTX) are not affected by this pin and are not gating.