feat(gpu): serve 6 models on worker-1 via KServe — vLLM v0.11.0 (bitsandbytes) + Ollama + TEI, plus RuntimeClass/privileged-PSA prereqs and a local-NVMe StorageClass, working around Volta sm_70 limits

Layout on 4x Tesla V100 32GB (PCIe, no NVLink), all TP=1:
  GPU0+1  vLLM    DeepSeek-R1-Distill-Qwen-32B bnb-nf4  (2 replicas)
  GPU2    Ollama  ornith:35b + qwen2.5:3b-instruct      (co-resident)
  GPU3    vLLM    Qwen2.5-Math-PRM-7B                   (reward model)
  CPU     TEI     nomic-embed-text-v2-moe, bge-reranker-base

Volta constraints, each verified against live output rather than config:
- vLLM pinned v0.11.0: sm_70 dropped from CUDA_SUPPORTED_ARCHS at v0.11.1.
- AWQ hard-rejected (needs sm_75). GPTQ passes vLLM's min_capability=60 gate
  but is NUMERICALLY WRONG on sm_70 — emits garbage logits. Proven by an fp16
  control run producing correct text on an identical backend. bitsandbytes nf4
  verified correct by output.
- flashinfer's check_cuda_arch() crashes on any sm_7x (calls .isdigit() on an
  int) -> VLLM_USE_FLASHINFER_SAMPLER=0.
- xformers has no sm_70 kernel for V1's paged-attention bias, and V0 was
  removed in v0.11.0 -> TRITON_ATTN.
- Ornith is Qwen3.5-MoE hybrid-attention; vLLM added that arch after dropping
  Volta, so no build has both -> Ollama, which also multiplexes a second model
  on the same card for free.

Cluster prereqs that were absent:
- RuntimeClass nvidia: the Talos toolkit extension registers the containerd
  handler but not the k8s object; without it every pod is rejected at admission.
- gpu-system pinned to privileged PSA: a device plugin cannot satisfy the
  cluster-default baseline, it must mount hostPath.
- device-plugin affinity=null: the chart requires NFD labels that do not exist
  here, so it matched zero nodes and reported desiredNumberScheduled=0 silently.
- Recreate strategy on GPU services: with GPUs allocated exactly 4/4, a
  RollingUpdate surge pod has no card and deadlocks the rollout.
- longhorn-llm-local SC (1 replica, strict-local, disk tag llm): the default
  3-replica class could not place the volume at all (every control-plane disk
  was at its over-provisioning ceiling), and this keeps ~60GB of weights on
  worker-1's own NVMe instead of reading them over the network.

deploy-gpu-serving.sh sequences ArgoCD syncs (or helm/kubectl in --manual mode)
and never applies a manifest absent from git; doctor/unstick/teardown stages
exist so this is diagnosable without ad-hoc kubectl archaeology.

k8s/apps/llm-serving/storageclass.yaml

@@ -0,0 +1,38 @@
+# Dedicated StorageClass for model weights on worker-1's local NVMe.
+#
+# Why not the default `longhorn` class (3 replicas, network-attached):
+#
+# 1. numberOfReplicas: 1 — model weights are re-downloadable from HuggingFace.
+#    Replicating them 3x buys nothing; losing a replica costs a re-pull, not
+#    data. The repo's "never delete a PVC without replicas/backups" rule exists
+#    for irreplaceable data, which this is not.
+#
+# 2. dataLocality: strict-local — keeps the single replica on the SAME node as
+#    the pod. All engines are pinned to worker-1, so weights are read from its
+#    local 751GB NVMe instead of over the network from a control-plane node.
+#    Removes ~60GB of network reads on every cold start.
+#
+# 3. diskSelector: llm — restricts this class to disks tagged `llm`, i.e. only
+#    worker-1's disk. Equally important, worker-1's disk carries that tag so
+#    UNTAGGED volumes (any ordinary cluster PVC) will not land on it. Before
+#    tagging, worker-1 had been silently hosting a replica of cicd/runner-dind,
+#    consuming GPU-node storage for general cluster workloads.
+#
+# The default 3-replica class also physically could not place this volume: all
+# three control-plane disks were already at their over-provisioning ceiling
+# (storage-over-provisioning-percentage=100, 30% reserved), so a 120Gi x3
+# request failed with ReplicaSchedulingFailure on every node.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-llm-local
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+parameters:
+  numberOfReplicas: "1"
+  dataLocality: "strict-local"
+  diskSelector: "llm"
+  staleReplicaTimeout: "30"
+  fsType: "ext4"