ci(docker): build the rollout engine from sglang's sglang-miles-h3 branch

[Rockdu]

What

Point the image's rollout engine at sglang's sglang-miles-h3 branch instead of main:
SGLANG_DIFFUSION_BRANCH=sglang-miles-h3, plus the three places that document or mirror that
default (docs/getting-started/installation.md, the install skill's prose, and
snapshot/pins.env).

Why

sglang-miles-h3 is upstream main plus the diffusion RL rollouts this repo drives before they
reach main. Today that is the MiniMax H3 t2va rollout (sgl-project/sglang#35598, merged): an
engine built from sglang main still rejects the run with MiniMax H3 does not support rollout.

Split out of #154 so the image change gets its own build: #154 comes from a fork, and
pr-test.yml's docker-build is guarded on head.repo.full_name == github.repository, so a fork
PR never builds the image it changes — the GPU suites there run inside the pre-change latest.
From a branch in this repo the guard passes and the Dockerfile actually gets built.

Validation

CI on this PR is the validation: docker-paths matches docker/Dockerfile, so docker-build
builds radixark/miles_diffusion:pr-<num> from sglang-miles-h3 and every GPU suite then runs
inside it.

Note

snapshot/pins.env keeps SGLANG_COMMIT=94eef833, which is an ancestor of sglang-miles-h3
(so the install skill's ancestor check still passes) but predates the H3 rollout merge. The
snapshot wants a refresh.sh pass against the next published image; that is a separate change.