fix(relearn): pin proven CUDA scoring eval image digest

[echobt]

Summary

• Pin config/relearn-pin.toml eval_image_digest to the runtime CUDA scoring image proven by CortexLM/relearn publish-eval-image on merge SHA 8ffbe8a0481cc62c1e2d6ed80a2211befa98dd3f.
• Digest sha256:4806db4bd6650415c3705290117fd0190cd2a6d387cef871dd3d9ff1a8bb6d7e. Runtime job pulled it, ran the harvest-PATH check, and proved import vllm, torchvision plus relearn-eval selftest.
• Publish: https://github.com/CortexLM/relearn/actions/runs/33730126042
• Not the contract slim python image (sha256:3ab0f45e…). Not sha256:cbc4bbb8…. Dead harvest failures stay named in the pin.

A live host still 503s until harvest + champion baseline are recorded. No terraform/helm.

Test plan

• cargo test -p relearn-eval --test committed_pin
• Confirm eval_image_digest is sha256:4806db4b… and relearn_git_sha is 8ffbe8a0…
• Confirm no cbc4bbb8 in the digest field
• CI green on this PR before merge

[greptile-apps]

Greptile Summary

Pins Relearn live evaluation to a specific CUDA scoring image and records the matching upstream source revision, with tests and operator documentation updated to match. Execution checks disproved two potential regressions: the new pin does not allow live scoring without a wired harvest, and the configured Git revision and GHCR image manifest are reachable and match the configured values.

Confidence Score: 5/5

Safe to merge based on the exercised Relearn readiness and public image-provenance checks.

No defects remain: the changed pin parses and validates, preserves the harvest prerequisite for live scoring, and points to a reachable upstream revision and image manifest.

Files Needing Attention: No files need further attention.

T-Rex Logs

What T-Rex did

• I ran a focused Relearn readiness check before and after the commit, observing that before the change the empty digest produced can_rent=false and Lium scoring returned EvalImageUnpinned, while after the change the pinned digest was rentable but Lium scoring without harvest returned LiveHarvestUnavailable and did not fall back to simulation.
• I validated the configured image and source revision by parsing TOML, validating the pin, resolving CortexLM/relearn@8ffbe8a, and confirming GHCR HTTP 200 for sha256:4806db...6d7e.
• I disproved the hypothesis that a newly non-empty pin would immediately enable an unsafe scorer, since scoring_readiness(pin, Lium, None) stayed at LiveHarvestUnavailable and did not fall back to Sim.
• I disproved the hypothesis that the digest/SHA was malformed or unreachable, because the TOML parser and pin validator passed and Git resolved the exact SHA while GHCR authenticated manifest lookups returned the expected digest.
• I authored the test source and reproducible runner and uploaded them with their captured output.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(relearn): pin proven CUDA scoring ev..." | Re-trigger Greptile}