docker: harden rollback, publish, shim, and view-cleanup paths

Ten verified fixes from a 12-reviewer audit of the image tooling, each
reproduced before fixing:

1. install_llama_prebuilt.py move_install_dir_aside: the EXDEV fallback
   copied straight into the rollback path, so a copy that died halfway
   (ENOSPC, I/O error) left a partial tree that activation recovery would
   later restore over the intact install while deleting the good copy.
   Copy to a temp sibling and publish with one atomic rename; dst.exists()
   is now a truthful complete-tree signal.

2. unsloth_run.py --out truncated the existing output before nbconvert
   ran, so a timeout, missing kernel, or failed cell irreversibly
   destroyed the previous result. The input copy and executed result are
   staged as temp files next to the destination and published with
   os.replace only on exit code 0.

3. unsloth_nb_view.py cleanup treated every symlink in the view as its
   own: user-created links (and an operator's view-root routing symlink)
   were deleted on every rebuild. Cleanup now removes only links that
   resolve into the notebooks tree it links from, and builds inside a
   view-root symlink's target instead of unlinking it.

4. unsloth_llama_update.sh: the unconditional EXIT trap deleted the .old
   backup even when it was the only remaining copy (signal between the two
   renames, or a failed swap whose restore also failed). The handler now
   restores the backup first when the install dir is missing and removes
   it only after the new tree is verifiably active; HUP/INT/TERM route
   through the same handler.

5. unsloth_pip_shim.py: transitive dependencies could replace the baked
   torch stack (reproduced with a wheel requiring torch==99.0). Every
   forwarded install now carries a constraints file pinning the installed
   protected set, turning the swap into ResolutionImpossible.

6. unsloth_pip_shim.py: ${UPPER} env references in requirements files were
   classified before pip expanded them, bypassing the protected-package
   filter; the shim now expands with pip's exact regex first.

7. unsloth_pip_shim.py: a failure writing the filtered requirements copy
   returned the ORIGINAL file, forwarding exactly the protected pins it
   had detected; it now fails closed.

8. docker-publish.yml: workflow_dispatch defaulted unsloth_ref to 'main'
   while the stable-tag gates require '', so UI-default manual runs could
   never advance :core/:latest/:studio; the default is now empty.

9. entrypoint.sh: the sm_103/sm_121 branch rewrote libnvrtc.so.12 to the
   CUDA-13 build but the ordinary-GPU branch never restored it, so a
   container moved to an older GPU kept the stale link; it is now reversed
   when it points exactly at the .cu13 target.

Rejected after verification (no code change): timeout=0 semantics are
documented at the site with no zero callers, TORCHINDUCTOR_COMPILE_THREADS
override is deliberate, fetchNews is a string enum per JupyterLab's schema,
:base tag appears in no in-tree doc, install-cell digest exclusion is the
module's stated contract, transformers ceiling semantics are documented,
and the cloudflared download mirrors the pre-existing Studio downloader
(Cloudflare publishes no checksum asset). The UNSLOTH_ALLOW_CPU import
crash lives in unsloth_zoo (compiler.py / loss_utils.py capability probes),
not in this diff; the image consumes the zoo fix automatically once merged
there.

Tests: shim suite extended to 63 (constraints, env expansion, fail-closed),
jit-selector suite to 14 (NVRTC reversal transitions), plus staged-publish
and ownership repros; wider studio install suite green except failures
reproduced at the unmodified head.

.github/workflows/docker-publish.yml

@@ -37,9 +37,14 @@ on:
   workflow_dispatch:
     inputs:
       unsloth_ref:
-        description: 'unsloth git ref to bake in'
+        # Blank means "the dispatched branch" (the resolver below falls back to
+        # the triggering sha, then main). The stable-tag gates (:core/:latest/
+        # :studio) require this input to be EMPTY -- stable tags only when the
+        # operator did not override the source ref -- so a non-blank default
+        # would make every UI-default dispatch publish SHA tags only.
+        description: 'unsloth git ref override (blank = dispatched branch + stable tags)'
         required: false
-        default: 'main'
+        default: ''
       unsloth_zoo_ref:
         description: 'unsloth-zoo git ref to bake in'
         required: false
@@ -114,10 +119,10 @@ jobs:
 
       # Freeze the requested unsloth ref to ONE concrete sha before the matrix
       # fans out, so both base arch legs AND the Studio build bake the identical
-      # unsloth commit even when the requested ref is a mutable branch (the
-      # workflow_dispatch default is unsloth_ref=main) that advances during the
-      # ~4h base + Studio run. Same requested-ref precedence the inline build-arg
-      # used: the dispatch input wins (default main), else the pushed tag, else
+      # unsloth commit even when the requested ref is a mutable branch that
+      # advances during the ~4h base + Studio run. Same requested-ref precedence
+      # the inline build-arg used: the dispatch input wins (blank by default,
+      # so stable tags stay enabled), else the pushed tag, else
       # the triggering commit sha, else main. A 40-char sha (branch/schedule
       # push) is already frozen; a branch/tag is resolved via ls-remote, exactly
       # like the zoo and notebooks steps, falling back to the bare ref on a
@@ -276,8 +281,8 @@ jobs:
           # passed as a bogus --build-arg. Explanations live here instead:
           #   UNSLOTH_REF (from the prepare job): resolved to ONE sha before the
           #     matrix fans out, so both arch legs and the Studio build bake the
-          #     identical unsloth commit even if a mutable branch (dispatch's
-          #     unsloth_ref=main default) advances mid-run. Same requested-ref
+          #     identical unsloth commit even if a mutable branch (an explicit
+          #     dispatch unsloth_ref) advances mid-run. Same requested-ref
           #     precedence as before: dispatch input, else the pushed tag, else
           #     the triggering commit sha, else main.
           #   UNSLOTH_ZOO_REF (from the prepare job): explicit dispatch input,