server: spec-boundary cache salvage + reasoning-budget round-trip fixes

[pugant]

Summary

Running Qwen3.8-27B (Q4_0_ROCMFP4_STRIX_LEAN) as a coding-agent backend with MTP
speculative decoding (n-max 6) and thinking enabled, every multi-turn conversation
with a client that resends reasoning_content (OpenAI-style agents such as pi 0.84+)
degrades the prompt cache to a cold fallback at each turn. This branch makes the
trailing-rollback of the spec boundary reliable and makes --reasoning-budget
usable as a hard thinking cap without breaking the cache.

What's in the series

1. Bounded trailing rollback for spec-boundary cache salvage — when the resent
   prompt diverges from the cached prefix only in trailing whitespace/merged-token
   deltas at the spec boundary, roll back to the last checkpoint instead of a full
   cold fallback.
2. Checkpoint-based rollback — keeps KV checkpoints at spec boundaries so the
   rollback above is O(delta) instead of O(context).
3. MTP boundary ring — pushes all batch/verify rows into the rollback ring so
   MTP-verified tokens are handled uniformly.
4. Forced-end round-trip fix — when the reasoning budget is exhausted, the
   forced sequence was message + end_tag; chat templates (Qwen3.8 and friends)
   re-render a resent assistant turn as <think>\n + reasoning_content + \n</think>\n\n, so the missing leading \n made every budget-truncated turn
   diverge on resend at exactly the reasoning boundary. The forced sequence now
   includes it (server + CLI call sites).
5. thinking_token_budget alias — accepts the vLLM field name for the
   per-request reasoning budget, used by pi-ai's openai-completions streamFn.
   Exact name thinking_budget_tokens and server default unchanged.

Test results (Qwen3.8-27B STRIX_LEAN, container, port 1235, MTP n6)

• Budget round-trip: 3 independent runs — resend verbatim of a budget-truncated
  turn (content + reasoning_content) → 0 cold fallback, 0 trailing rollback
  (exact cache hit at token level).
• No-budget regression: natural thinking closure + resend → 0 cold fallback.
• Agent workload (pi, 12 requests, --reasoning-budget 2048): 3 budget
  exhaustions + forced closures, 6 natural — 0 cold fallback.

Known limitations (disclosed)

• The trailing-rollback path has a known flaky edge case under a specific
  interleaving (documented in our test plan); the common agent flows are stable.
• A manual stop/resume of the client mid-generation still produces a cache skip
  (the truncated turn is not round-trippable) — the checkpoint rollback does not
  currently cover client-truncated turns.

Repro/scripts

Test scripts available in the PR discussion on request (deterministic
round-trip, warm-vs-cold, per-request alias checks).

[pugant]

Update: added commit 3 — checkpoint-based cache salvage for older divergences

The trailing rollback was bounded by the speculative boundary ring, so a resend that diverges further back than the retained boundary window (e.g. a reasoning drop or client-side compaction on a long agent conversation) still paid a full cold reprocess of the whole prompt — minutes of prefill on a 45k-token context, reproducing the "forcing full prompt re-processing" symptom from upstream #21831.

New behavior: when the ring cannot rewind, restore the newest context checkpoint at or below the divergence point (target + draft + speculative-impl boundary state, now snapshotted together in common_prompt_checkpoint::data_spec) and replay only the tokens after it.

Verified on Qwen3.8-27B (hybrid recurrent) + MTP n6, two full scripted runs:

• divergent resend at lcp=41195/cached=45684 → checkpoint rollback at [41191,41191], 4,044 tokens reprocessed instead of 45,236 (~91% saved), generation completes normally
• altered resends (reasoning dropped / truncated) now go through the checkpoint path instead of cold-reprocessing
• clean verbatim baseline unchanged (exact hits / small trailing rollbacks), zero aborts

The boundary-state snapshot is the key detail: restoring target+draft KV without the MTP boundary row at the restore position makes every replay batch fail its draft sync ("missing MTP boundary") and eventually aborts the server on empty batches — the state must travel with the checkpoint.