GLM-5.3 Flash: activate pooled HiCache on replica 2

[PierreLeGuen]

Prepare the r2-only GLM-5.3 Flash HiCache activation using the signed image built from the merged runtime in #252. Retain r1 as the HiCache-disabled control and keep the RAM budget configurable through deployment environment variables.

Acceptance:

• Publish and verify the immutable image, pinned build provenance, SBOM and signature.
• Pin that image only on r2 and verify all other runtime/routing settings remain intact.
• Pass compose, collector, production-contract and promotion regression checks.
• Complete exact-topology TEE/PPCIe staging with confirmed CPU-cache restores and at least a 30-minute soak before production deployment.

Related research and overall rollout tracking: #251. Runtime preparation: #252.

Activation PR: #255

Release run: https://github.com/nearai/cvm-compose-files/actions/runs/34515370239 — succeeded; immutable image, provenance, SBOM, GitHub attestation and Cosign signature verified. Scan: zero fixable CRITICAL findings, 62 fixable HIGH findings still visible for review.

Production has not been changed. Exact-topology TEE/PPCIe staging and separate explicit production-deployment approval remain pending.