chore: bump vLLM nightly to 93d8f834; 0.23.1-rc.0:9 → 0.23.1-rc.0:10

[helix-nine]

Summary

Advances the bundled vLLM nightly from commit a16dbd5 → 93d8f834 (71 upstream commits). Still on the upstream 0.23.1rc0 line — git describe from the new commit resolves to v0.23.1rc0 (v0.24.0 is tagged on a release branch, not an ancestor of the nightly main line), so UPSTREAM_VLLM_VERSION is unchanged and the StartOS revision bumps :9 → :10.

• NIGHTLY_SHA → 93d8f834dd8acf33eb0e2a75b2711b628cb6e226 (advances both vllm/vllm-openai and vllm/vllm-openai-rocm prebuilt nightly images; confirmed both nightly-93d8f834… tags exist on Docker Hub for nvidia + rocm).
• vllm/ submodule checked out at the matching commit for the cpu source build.
• UPSTREAM_VLLM_VERSION unchanged (0.23.1rc0) — nearest reachable release tag is still v0.23.1rc0.
• startos/versions/current.ts → 0.23.1-rc.0:10 with refreshed release notes (all locales).
• start-sdk already at latest (1.5.3); npm update made no changes.

Upstream highlights (a16dbd5…93d8f834)

• Security: image decompression-bomb OOM DoS fix (#47010); bounded tokenizer work when an explicit truncation_side is set (#47007).
• Core: pluggable sleep-mode backend abstraction (#44074).
• Frontend: new streaming parser engine with Kimi k2.5/k2.6/k2.7 tool-call support (#46610).
• Spec decode: SWA + DFlash for MiMo (#46104); block verification for rejection sampling (#46781).
• Attention: new HPC-Ops attention backend (#46020); GLM5 FlashMLA FP8 KV cache (#47090).
• Removed: Tarsier / Tarsier2 model architectures (#47143).

Full diff: vllm-project/vllm@a16dbd5...93d8f83

Test plan

• npm run check (tsc) — green.
• make/s9pk pack deferred to PR review per the monitor cycle.