build(docker): pin the llama.cpp image by digest

The :server-cuda tag is a moving target, so a fresh pull could silently
change server behaviour (flags, the baked-in healthcheck, ...). Pin the
default image to the current digest for reproducibility; overriding `image`
in the config or via --image still works. A comment documents how to bump
the pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/SECURITY_AND_OPERATIONS.md

@@ -34,7 +34,8 @@ testbar von der Orchestrierung.
 
 1. **Eingebaute Defaults** (`config.builtin_defaults()`) — spiegeln die
    Standardwerte der ursprünglichen Shell-Skripte wider (Image
-   `ghcr.io/ggml-org/llama.cpp:server-cuda`, `host_port=8001`,
+   `ghcr.io/ggml-org/llama.cpp` per Digest gepinnt für Reproduzierbarkeit,
+   `host_port=8001`,
    `container_name=va_llm`, `gpu_device=1`, `jinja/fa/kv_unified/
    cont_batching/no_context_shift=true`, `reasoning=on`,
    `cache_type_k/v=q4_0`, `batch_size=1024`, `ubatch_size=512`,

llama.cpp.config.example

@@ -14,7 +14,9 @@
 # locking (--change), and --stop/--check targeting.
 
 [default]
-image = ghcr.io/ggml-org/llama.cpp:server-cuda
+# Pinned by digest for reproducibility. The :server-cuda tag is a moving target;
+# to update, pull it, read the new digest, and replace the pin below.
+image = ghcr.io/ggml-org/llama.cpp@sha256:5535de118ed457f761cbfeacd7e10fef31cb391ca7cac1d5c78b11d28fcf88e6
 # hf_home unterstützt Environment-Variablen und ~, z. B. hf_home = ${HF_HOME}
 hf_home = /srv/models
 model_path = qwen3/default.gguf

src/llamacppctl/config.py

@@ -36,7 +36,10 @@ class ConfigError(ValueError):
 def builtin_defaults() -> dict:
     """Mirrors the original start-llm-server.sh / status-llm-server.sh defaults."""
     return {
-        "image": "ghcr.io/ggml-org/llama.cpp:server-cuda",
+        # Pinned by digest for reproducibility (the :server-cuda tag is a moving
+        # target). To update: docker pull ghcr.io/ggml-org/llama.cpp:server-cuda,
+        # read the new digest, and bump it here (or override `image` in the config).
+        "image": "ghcr.io/ggml-org/llama.cpp@sha256:5535de118ed457f761cbfeacd7e10fef31cb391ca7cac1d5c78b11d28fcf88e6",
         "hf_home": "/models",
         "model_path": "qwen3/default.gguf",
         "container_name": "va_llm",