fix(cvm): patch vLLM Harmony streaming tool-call fallback

[jfrery]

Summary

• Patches vLLM v0.13.0 to fix Harmony streaming mode occasionally missing tool-call deltas at finish time
• Adds cvm/vllm-patch/ with a Dockerfile overlay that applies the fix at image build time
• Publishes patched image as ghcr.io/concrete-security/vllm-openai:v0.13.0-harmony-fix
• Updates docker-compose.yml to use the patched image

Details

Harmony mode can finish streaming without emitting tool-call deltas even when the full token stream contains a valid function call. The fix adds a fallback that re-parses accumulated harmony tokens once at finish time to recover missed tool calls.

Test plan

• Deploy CVM with updated docker-compose and verify tool calls work in streaming mode
• Verify the patched image builds cleanly: cd cvm/vllm-patch && docker build .

[github-actions]

🚀 Vercel preview: https://v0-saas-landing-page-fgz7gem0u-jordanfrery-3725s-projects.vercel.app

[youben11]

We need to have a workflow to build (potentially test) the image, push it to ghcr, and also add provenance since we are doing the build of vllm now

[jfrery]

We need to have a workflow to build (potentially test) the image, push it to ghcr, and also add provenance since we are doing the build of vllm now

yes I will add. But eventually we will use vllm once the proper fix is in vllm

ref vllm-project/vllm#35449

[youben11]

If it lands and the image is just temporary, then okay. Let's see depending on the PR state