fix(llm-serving): pull clef-candle's mutable tag on every start

:sm70 is rebuilt by CI on every merge to candle-vllm main. The default
IfNotPresent means a node with a cached copy of that tag keeps running the old
binary, so a fix can be merged and deployed and still never reach the pod. The
symptom is a 404 on /v1/systemone while the image tag looks correct.

Always forces the pull.

k8s/apps/llm-serving/clef-candle.yaml

@@ -42,6 +42,11 @@ spec:
           # and makes every linear-attention layer return zero. The symptom is
           # a well-formed /v1/systemone response with wrong answers, not an error.
           image: forgejo.riotpiao.com/riotpiao-poimen/candle-vllm:sm70
+          # :sm70 is a moving tag. With the default IfNotPresent a rebuilt image
+          # is never pulled while any node holds a cached copy of that tag, so the
+          # cluster keeps serving the old binary and the fix looks like it did not
+          # land. Always forces the pull on every pod start.
+          imagePullPolicy: Always
           command: ["/usr/local/bin/candle-vllm"]
           # clef-flash is a hybrid Qwen3_5 model: 8 full-attention layers plus 24
           # GDN layers that carry per-sequence recurrent state. It runs on ONE