fix(ci): pin the model server by digest and preflight streamed tool calls

[siarheidudko]

What happened

The live-model gate from #39 failed on its first real run and skipped the publish. It was right to block, but it blocked for my mistake, not a real regression.

The pin was wrong. server-bNNNN tags stop at b5350 (May 2025) because the project renamed its tags afterwards — so "the newest server-b tag" silently meant a year-old build. That build serves plain chat perfectly and answers every streamed tool call with:

{"code":500,"message":"Cannot use tools with stream","type":"server_error"}

The executor streams, so every tool call 500'd and the run died inside the agent with nothing in the failure pointing at the runtime. Current build is b10450.

Fix

• Pin by digest, not by tag (@sha256:0668d42b…, = b10450). A digest cannot rot into a different meaning the way a naming scheme can; :server is the floating tag to resolve when bumping.
• Preflight step: one streamed tool call, asserted before the model's judgement is ever involved, failing with a message that names the image. Verified it discriminates rather than assuming it does:

Image	Preflight
server-b5350 (the one that broke the release)	HTTP 500 Cannot use tools with stream
@sha256:0668d42b… (b10450)	HTTP 200, streamed deltas

The model floor, re-measured on the new image

Since the runtime changed, the earlier 1.5B-vs-3B comparison had to be redone rather than carried over — it was made on a self-built server, so it proved nothing about this one.

Model	Result on the pinned image
Qwen2.5-3B	passes — calls files__secret, real value in the final text (28s)
Qwen2.5-1.5B	fails 3/3, calls: [] — never touches the tool

So the floor stays at 3B. The 1.5B would run roughly 20s faster per attempt against weights that are cached anyway; the price is a test that cannot fail for the reason it exists.

Checks

typecheck, format:check, build, test green (171 pass, 1 skipped). The live-model test itself was run against the pinned image locally — 1 pass — and the preflight was verified against both images.

---

Generated by Claude Code