build(images): digest-pin glm53 base image — tag glm53-flash-arm64-cu130 is mutable; pin sha256:905c0293 (the base our verified images were built on). Checksum changes → one no-op rebuild on next serve.

docker-images/glm53-flash-nvfp4-lab/versions.env

@@ -1,4 +1,4 @@
 # Authoritative build inputs for the GLM-5.3-Flash NVFP4 (local-inference-lab)
 # SM121 image: day-0 vLLM image + the NoPE-MLA GB10 mod + the lab-checkpoint
 # patches (see Dockerfile and patches/UPSTREAM.md).
-BASE_IMAGE=vllm/vllm-openai:glm53-flash-arm64-cu130
+BASE_IMAGE="vllm/vllm-openai:glm53-flash-arm64-cu130@sha256:905c02933be6021301db2dc284e24e3727467aa3a0f63b41d609885778a07bce"  # digest-pinned: tested base; tag is mutable

docker-images/glm53-flash-nvfp4/versions.env

@@ -2,4 +2,4 @@
 # Base: vLLM day-0 per-model image (arm64/cu130, glm5_next arch support
 # baked in). The patches/ dir carries the NoPE-MLA + sm120 sparse-MLA GB10
 # fixes (see Dockerfile).
-BASE_IMAGE=vllm/vllm-openai:glm53-flash-arm64-cu130
+BASE_IMAGE="vllm/vllm-openai:glm53-flash-arm64-cu130@sha256:905c02933be6021301db2dc284e24e3727467aa3a0f63b41d609885778a07bce"  # digest-pinned: tested base; tag is mutable