[fork] Bump to upstream v0.28.0

[Mazyod]

Lockstep release sync from v0.27.1 to upstream v0.28.0, per FORK.md § Lockstep.

What changed

• Merged the release tag, resolved wholesale against it. v0.27.1 is a release branch, not an ancestor: it carries 21 commits absent from v0.28.0 touching 37 files, and only 6 of those conflict. docker/Dockerfile auto-merges without conflicting and silently keeps two release-branch hunks — an R1 violation that conflict-only resolution cannot catch. Resolved with git read-tree -u --reset v0.28.0 plus a restore of the ledger's five add patterns, which makes "every upstream path is byte-identical to the tag" a property of the merge rather than something a human verifies file by file.
• Retired the transformers==5.14.1 pin. Its exit criterion is met: 70b84f0bcb (Fix Gemma 4 for upcoming Transformers version vllm-project/vllm#49797) is in v0.28.0 and the fix is version-agnostic. Deleted rather than repinned — the fork's goal is parity with upstream, and a divergence survives only while necessary, not while precautionary.
• Declared .github/workflows/buf.yml (new upstream, inert on a fork but carries a nightly cron) in fork/alignment.ledger.
• Created fork/bench/configs/v0.28.0/. Engine flag content is byte-identical to v0.27.1 — a key-by-key audit found only two non-SAFE keys and nothing renamed. Comments were re-justified where the release changed their meaning, notably Qwen's no-enable-prefix-caching (v0.28.0 flips the hybrid default ON, [Mamba] enable prefix cache by default vllm-project/vllm#50991) and DeepSeek's cudagraph_mode (DSV4 now defaults to Model Runner V2, [Bugfix] Guard DeepSeek V4 MRV1 piecewise CUDA graphs vllm-project/vllm#51768/[Bugfix] Pick the DeepSeek V4 eager cudagraph region per model runner vllm-project/vllm#52401, making the runner the load-bearing knob).
• Tied the release pins together. The release string was written down in six places; a new test asserts four of them agree, and the rest now derive from profiles.DEFAULT_TAG.
• Made a negative arm that stops failing visible. profile.expect never reached a probe, verdict, or the report, so a boot_crash arm that served rendered as an ordinary pass. It now reports a mismatch — and a declared crash must prove it crashed, since R5 also fails on a zero-line log, and both negative arms carry R5 as their only probe.

Testing

• fork/bench/tests: 441 passed, 4 skipped.
• bash fork/bench/preflight.sh: PREFLIGHT GREEN (440 passed, 5 skipped).
• fork/scripts/check-alignment.sh: Aligned, exit 0 — 102 declared adds, 10 declared deletes, zero modified upstream files.
• Dry run against fixtures and the mock: exit 0, 51 probe results, 49 pass + 2 fail-as-expected.
• Local image build against the real vllm/vllm-openai:v0.28.0 base succeeded: Ubuntu 24.04.3, glibc 2.39, patch 2.7.6, import av, soundfile clean, vllm 0.28.0, transformers 5.15.1 (now unpinned).
• pre-commit run --files <branch changes>: clean apart from two pre-existing/upstream issues — fork/bench/gate.py:15's import re (predates this branch; regex is not importable in the bare uv run --no-project env the tooling uses) and shellcheck, which is repo-wide and fails on 15 upstream scripts with zero fork/ hits.

Hardware gate results will be added before promotion. :latest moves only via a promote_from dispatch on the gated digest.

AI assistance

AI assistance was used throughout, under human direction and review.