feat(gpu): serve 6 models on worker-1 via KServe — vLLM v0.11.0 (bitsandbytes) + Ollama + TEI, plus RuntimeClass/privileged-PSA prereqs and a local-NVMe StorageClass, working around Volta sm_70 limits

Layout on 4x Tesla V100 32GB (PCIe, no NVLink), all TP=1:
  GPU0+1  vLLM    DeepSeek-R1-Distill-Qwen-32B bnb-nf4  (2 replicas)
  GPU2    Ollama  ornith:35b + qwen2.5:3b-instruct      (co-resident)
  GPU3    vLLM    Qwen2.5-Math-PRM-7B                   (reward model)
  CPU     TEI     nomic-embed-text-v2-moe, bge-reranker-base

Volta constraints, each verified against live output rather than config:
- vLLM pinned v0.11.0: sm_70 dropped from CUDA_SUPPORTED_ARCHS at v0.11.1.
- AWQ hard-rejected (needs sm_75). GPTQ passes vLLM's min_capability=60 gate
  but is NUMERICALLY WRONG on sm_70 — emits garbage logits. Proven by an fp16
  control run producing correct text on an identical backend. bitsandbytes nf4
  verified correct by output.
- flashinfer's check_cuda_arch() crashes on any sm_7x (calls .isdigit() on an
  int) -> VLLM_USE_FLASHINFER_SAMPLER=0.
- xformers has no sm_70 kernel for V1's paged-attention bias, and V0 was
  removed in v0.11.0 -> TRITON_ATTN.
- Ornith is Qwen3.5-MoE hybrid-attention; vLLM added that arch after dropping
  Volta, so no build has both -> Ollama, which also multiplexes a second model
  on the same card for free.

Cluster prereqs that were absent:
- RuntimeClass nvidia: the Talos toolkit extension registers the containerd
  handler but not the k8s object; without it every pod is rejected at admission.
- gpu-system pinned to privileged PSA: a device plugin cannot satisfy the
  cluster-default baseline, it must mount hostPath.
- device-plugin affinity=null: the chart requires NFD labels that do not exist
  here, so it matched zero nodes and reported desiredNumberScheduled=0 silently.
- Recreate strategy on GPU services: with GPUs allocated exactly 4/4, a
  RollingUpdate surge pod has no card and deadlocks the rollout.
- longhorn-llm-local SC (1 replica, strict-local, disk tag llm): the default
  3-replica class could not place the volume at all (every control-plane disk
  was at its over-provisioning ceiling), and this keeps ~60GB of weights on
  worker-1's own NVMe instead of reading them over the network.

deploy-gpu-serving.sh sequences ArgoCD syncs (or helm/kubectl in --manual mode)
and never applies a manifest absent from git; doctor/unstick/teardown stages
exist so this is diagnosable without ad-hoc kubectl archaeology.

k8s/apps/llm-serving/inferenceservice-embeddings.yaml

@@ -0,0 +1,74 @@
+# Embeddings — Nomic Embed Text v2 (MoE), on CPU via HuggingFace TEI.
+#
+# CPU, not GPU, deliberately. All 4 V100s are claimed by the generation models,
+# and the device plugin hands out WHOLE GPUs — a 5th GPU-requesting pod is
+# unschedulable no matter how much VRAM is free. Sharing would need global
+# time-slicing, which on a single node cannot be scoped to one card and would let
+# the scheduler co-locate two ~20GB models and OOM both.
+#
+# worker-1 has 96 cores with ~250m requested, and this is a 475M-param encoder
+# (305M active). Retrieval runs once per agent-loop iteration, not per token, so
+# CPU latency here is immaterial. This is also what Plan 1 originally specified.
+#
+# TEI (not vLLM) because it is purpose-built for encoders and explicitly lists
+# nomic-embed-text-v2-moe as supported.
+#
+# NOTE: Nomic v2 requires task prefixes on the CLIENT side —
+#   documents: "search_document: <text>"
+#   queries:   "search_query: <text>"
+# Embedding without the prefix silently degrades retrieval quality.
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  name: embeddings
+  labels:
+    app.kubernetes.io/name: llm-embeddings
+    app.kubernetes.io/part-of: llm-serving
+spec:
+  predictor:
+    minReplicas: 1
+    maxReplicas: 1
+    # Pinned to worker-1 only so it can share the RWO models PVC with the GPU
+    # pods (RWO = single node, any number of pods on it).
+    nodeSelector:
+      kubernetes.io/hostname: worker-1
+    containers:
+      - name: kserve-container
+        image: ghcr.io/huggingface/text-embeddings-inference:cpu-1.8.2@sha256:4d632b76bd14cb57044a1ffb0ad48ab0ba4939e705a9a615ccc740658575c26e
+        args:
+          - --model-id=nomic-ai/nomic-embed-text-v2-moe
+          - --port=8080
+          - --hostname=0.0.0.0
+          # Truncate rather than 413 on over-long input.
+          - --auto-truncate
+        env:
+          - name: HUGGINGFACE_HUB_CACHE
+            value: /mnt/models
+        ports:
+          - containerPort: 8080
+            protocol: TCP
+        resources:
+          requests:
+            cpu: "8"
+            memory: 4Gi
+          limits:
+            cpu: "16"
+            memory: 8Gi
+        volumeMounts:
+          - name: models
+            mountPath: /mnt/models
+        startupProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          periodSeconds: 10
+          failureThreshold: 60
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          periodSeconds: 10
+    volumes:
+      - name: models
+        persistentVolumeClaim:
+          claimName: llm-models