Docker notebook safety hardening and vLLM startup timeout fix

pip shim (docker/unsloth_pip_shim.py):
- Drop protected packages named via a VCS/URL #egg=NAME fragment so
  git+... #egg=torch no longer reinstalls into the baked venv.
- Filter constraint files (-c/--constraint) through the same protected
  package filter as requirement files, so a pinned torch/transformers in
  a constraint cannot downgrade the baked stack during resolution.
- Recursively filter nested -r/-c includes and absolutise their paths so
  the filtered /tmp copy still resolves them and no protected spec deep in
  the include tree slips past the keep list.
- Remove an unused subprocess import.

Notebook environment:
- Scope the transformers-request marker per kernel (UNSLOTH_NB_TF_MARKER
  keyed on the kernel connection-file id) so concurrent notebooks no
  longer read each other's pin.
- Install the IPython startup hook under IPYTHONDIR (set via ENV) so it
  loads for any uid, including docker run --user, not just root.
- unsloth_nb_content_sig.py: only treat a %%capture / %%bash cell as
  install boilerplate when it carries an install command, so substantive
  captured/bash cells are hashed and upstream changes are not skipped.
- unsloth_run.py: clean up the temp dir used to materialise a downloaded
  notebook.
- unsloth_sync_notebooks.sh: honor UNSLOTH_KEEP_DELETED_NOTEBOOKS across
  GitHub refreshes so a deleted notebook is not restored when upstream
  advances.

install_python_stack.py: the --local unsloth-zoo overlay now honors
UNSLOTH_ZOO_REF (default main), matching the install.sh overlay.

synthetic.py: preserve the timeout=None unbounded vLLM startup wait
instead of coercing it to 1200s.

studio/install_python_stack.py

@@ -2045,6 +2045,12 @@ def install_python_stack() -> int:
     package_name = os.environ.get("STUDIO_PACKAGE_NAME", "unsloth")
     # --local overlays a local repo checkout after updating deps.
     local_repo = os.environ.get("STUDIO_LOCAL_REPO", "")
+    # unsloth-zoo git ref for the --local overlay. Honor UNSLOTH_ZOO_REF (the
+    # Docker publish workflow / unsloth-studio-update resolve one ref and forward
+    # it) so the Studio venv can track the operator-requested zoo instead of
+    # always main. Unset -> main, byte-identical to the previous bare git URL.
+    zoo_ref = os.environ.get("UNSLOTH_ZOO_REF", "").strip() or "main"
+    zoo_git_spec = "unsloth-zoo @ git+https://github.com/unslothai/unsloth-zoo@" + zoo_ref
     base_total = 11 if IS_WINDOWS else 12  # +1 for the anyio repair check (step 8b)
     if IS_MACOS:
         base_total -= 1  # triton step is skipped on macOS
@@ -2154,13 +2160,13 @@ def install_python_stack() -> int:
                 local_repo,
                 constrain = False,
             )
-            _step(_LABEL, "overlaying unsloth-zoo from git main")
+            _step(_LABEL, f"overlaying unsloth-zoo from git {zoo_ref}")
             pip_install(
-                "Overlaying unsloth-zoo from git main",
+                f"Overlaying unsloth-zoo from git {zoo_ref}",
                 "--no-cache-dir",
                 "--no-deps",
                 "--force-reinstall",
-                "unsloth-zoo @ git+https://github.com/unslothai/unsloth-zoo",
+                zoo_git_spec,
                 constrain = False,
             )
     elif local_repo:
@@ -2185,13 +2191,13 @@ def install_python_stack() -> int:
             local_repo,
             constrain = False,
         )
-        _step(_LABEL, "overlaying unsloth-zoo from git main")
+        _step(_LABEL, f"overlaying unsloth-zoo from git {zoo_ref}")
         pip_install(
-            "Overlaying unsloth-zoo from git main",
+            f"Overlaying unsloth-zoo from git {zoo_ref}",
             "--no-cache-dir",
             "--no-deps",
             "--force-reinstall",
-            "unsloth-zoo @ git+https://github.com/unslothai/unsloth-zoo",
+            zoo_git_spec,
             constrain = False,
         )
     elif package_name != "unsloth":