Harden serving recipe cache freshness and provenance

[amd-mkarvir]

Summary

• make recipe-cache freshness a mandatory, fail-closed preflight
• write refreshed data to a writable runtime cache and record source provenance plus an immutable ROCm image digest
• select the highest stable semantic vLLM tag across every Docker Hub result page
• resolve runtime and CLI cache paths consistently, including environment-variable expansion
• require version checks and safer handling when a requested model is absent from the refreshed cache
• fix UTF-8 recipe parsing on Windows and add CI-backed regression tests

Motivation

The bundled recipe snapshot is a fallback and can become stale. The previous helper always exited successfully when refresh failed, allowing callers to continue without a reliable freshness signal. It also selected an older Docker version simply because it was updated recently, and it did not record the image digest needed to reproduce the exact container.

This change makes refresh failures observable and keeps stale fallback use explicit.

Validation

• repository skill validation passes
• eval dataset validation passes
• ten recipe-cache unit tests pass
• workflow YAML and Python compilation pass
• live synchronization smoke test passes against the public vLLM recipes repository and Docker Hub

This complements #126: that PR expands behavioral coverage, while this change hardens the deterministic cache and provenance path.

[amd-mkarvir]

CI note: All non-secret-dependent validation passed, including the new recipe-cache unit-test job, skill validation, eval-schema validation, manifests, external references, and SkillSpector.

[amd-mkarvir]

Local routing-eval result

Reproduced the failed Routing (whole catalog) job locally against commit 9afb63059df13f7c118cc6b9d1fca895cc28a20a.

python eval/run_evals.py --mode routing --min-accuracy 0 --no-extended \
  --output routing-report-individual-local.json \
  --keep-logs routing-logs-individual-local

• Claude Code: 2.1.167
• Model / effort: opus / high
• Result: 48/52 correct (92.3%)
• Errors: 0
• Wrong-skill / false-trigger cases: 0 / 0
• Positive prompts: 25/29 (86%)
• Near misses: 18/18 (100%)
• Unrelated prompts: 5/5 (100%)

For the skill changed by this PR:

Skill	Expected	Correct	Recall	Precision
serving-llms-on-instinct	5	5	100%	100%

All five serving cases passed: serve-tiny-model-on-instinct, qwen-on-mi300x, vllm-rocm-node, openai-compatible-mi355x, and deploy-datacenter-gpu.

The four catalog-wide misses were outside this PR''s skill:

• hyperloom-launcher-gates
• hyperloom-workload-intake
• lemond-health-check
• local-mode-without-api-key

This local result demonstrates that the PR''s serving-skill routing cases pass.

[danielholanda]

@amd-mkarvir Please let us know when this is ready to be reviewed

[danielholanda]

We are in the process of significantly refactoring the skill testing harness. If you would like to proceed with the PR, please remove changes made outside the skill folder.

[danielholanda]

All workflows are skill-agnostic. Please do not modify anything inside .github/workflows to enable skill-specific tests.