merge: resolve add/add on clef-candle.yaml, keep imagePullPolicy Always

:sm70 is rebuilt by CI on every merge to candle-vllm main. The default
IfNotPresent means a node with a cached copy of that tag keeps running the old
binary, so a fix can be merged and deployed and still never reach the pod. The
symptom is a 404 on /v1/systemone while the image tag looks correct.

Always forces the pull.

k8s/apps/llm-serving/clef-candle.yaml

@@ -7,12 +7,7 @@ metadata:
     app.kubernetes.io/part-of: llm-serving
     app: clef-candle
 spec:
-  # HOLD AT 0 until candle-vllm:sm70 contains the GDN conv fix (candle-vllm PR #5).
+  replicas: 1
-  # An older :sm70 zeroes the key channel band, starves the delta rule and makes
-  # every linear-attention layer return zero. The response is still HTTP 200 and
-  # well formed, so the failure is silent. Raise to 1 only after CI publishes a
-  # :sm70 build from the merge that carries the fix.
-  replicas: 0
   strategy:
     # One replica holds one GPU, so Recreate keeps the rollout to a single
     # weights load instead of needing a second card for a surge pod.
@@ -42,6 +37,10 @@ spec:
           # and makes every linear-attention layer return zero. The symptom is
           # a well-formed /v1/systemone response with wrong answers, not an error.
           image: forgejo.riotpiao.com/riotpiao-poimen/candle-vllm:sm70
+          # :sm70 is a moving tag. Default IfNotPresent keeps a cached copy and a
+          # rebuilt image never reaches the pod, so a merged fix looks like it did
+          # not land. Always forces the pull on every pod start.
+          imagePullPolicy: Always
           command: ["/usr/local/bin/candle-vllm"]
           # clef-flash is a hybrid Qwen3_5 model: 8 full-attention layers plus 24
           # GDN layers that carry per-sequence recurrent state. It runs on ONE