chore: bump vLLM nightly to ecf9d83; 0.23.1-rc.0:2 → 0.23.1-rc.0:3

[helix-nine]

Summary

Advances the bundled vLLM nightly build from commit 4c62663 to ecf9d83 (still on the upstream 0.23.1rc0 line). StartOS version 0.23.1-rc.0:2 → 0.23.1-rc.0:3.

Kept in lockstep per UPDATING.md:

• NIGHTLY_SHA → ecf9d83520eb217401b47d8a5451a27c5231b8c2 (advances both vllm/vllm-openai and vllm/vllm-openai-rocm prebuilt nightly tags — confirmed present on both Docker Hub repos).
• vllm/ submodule checked out at ecf9d83.
• UPSTREAM_VLLM_VERSION unchanged (0.23.1rc0) — the new commit is 193 commits past v0.23.1rc0 with no newer tag, so the cpu build version string is unchanged.
• startos/versions/current.ts version + release notes (all 5 locales).

No SDK bump — @start9labs/start-sdk already pins the latest published 1.5.3. npm update touched only package-lock.json.

Upstream highlights (4c62663…ecf9d83, 92 commits)

• Security: Starlette bumped to ≥1.0.1 for CVE-2026-48710 (#45675); audio-decode duration limit enforced in the chat-completions path (#45908).
• Models: MiniMax-M3-MXFP4 support (#45896); DeepSeek-V4 TEP=16 for block-FP8 shared expert (#46001). BambaForCausalLM removed (#45990).
• Parsing: new streaming parser engine with GLM4.7/GLM5.1/GLM5.2 parsers (#45915).
• Rust frontend: /abort_requests (#44382), /get_world_size (#44801), prompt-only completions (#44938), richer /v1/models metadata (#45950).
• Fixes: corrupt MoE FP8 LoRA outputs (#42120), NaN hidden states on hybrid-attention models (#45849), Gemma4 reasoning rendering (#45867), Qwen3 tool-call parsing (#46047).

Full diff: vllm-project/vllm@4c62663...ecf9d83

Test plan

• npm run check (tsc) green.
• make / s9pk pack — in review.

[helix-nine]

Thanks for the review and merge, @MattDHill. Nightly bump shipped (ecf9d83, 0.23.1-rc.0:3).