Add Qwen 3.8 Max (2.4T) as a verifiable teacher via yunwu

[ai-hpc]

Adds the qwen provider pinned to the yunwu slug qwen3.8-max, so datasets distilled from Qwen 3.8 Max verify like any other production teacher — the slug is committed into request_sha256 and the gateway's response model is re-checked against it.

The pin is enforced in both directions

This is the part that matters. A one-way check only proves that some pinned teacher was used, not which one:

Case	Result
qwen / qwen3.8-max	✅ accepted
qwen claiming claude-fable-5	❌ rejected
anthropic claiming qwen3.8-max	❌ rejected
qwen / qwen-turbo	❌ rejected

gpt-5.6-sol stays in ALLOWED_MODELS on purpose

SparkDistill has retired it as a generation teacher — no new trajectory will be built with it. It is deliberately not removed here, because 23 already-merged registry entries were proved with it and mix_registry --all re-reads every one when rebuilding the canonical mining dataset.

Removing it would retroactively invalidate the data behind the current frontier. Retiring generation and revoking verification are different actions, and only the first was asked for. There's a test pinning that behavior.

⚠️ Slug confirmation still required

qwen3.8-max must match what yunwu actually serves, and must stay identical to SparkDistill's teacher/providers.py: QWEN_TEACHER_MODEL.

Drift does not fail at generation time — it fails at verification, after the GPU hours are spent. Please confirm against yunwu's /v1/models before any production run.

Verification

• 391 tests pass (6 new), ruff clean
• Historical gpt-5.6-sol → gpt-5.6 normalization confirmed unchanged

Sequencing

This needs a release + pin bump before Qwen data can merge in SparkDistill: dataset_registry.yml pins SparkProof at 3104e28 (v0.3.0), which has no qwen provider. Until that pin moves, a Qwen bundle generates fine and is rejected by the gate.