chore: align @qvac/sdk addon pins on the fabric-10069.1.1 releases

[iancris]

🎯 Problem

The SDK's native addon floors sit one fabric build behind. After
#3854 they resolve qvac-fabric
10069.1.0, which misses 10069.1.1 — the fix for MoE models emitting garbage
on Adreno 830 OpenCL, which also re-enables the GPU MoE kernels that were
silently falling back to CPU.

Keeping the llama-family pins spread across different fabric builds is not
cosmetic. These addons all ship backend libraries with identical filenames
(libqvac-ggml-cpu-*.so, libqvac-ggml-vulkan.so), and the mobile e2e consumer
app flattens every addon's native libs into one lib dir, so only one addon's
copy survives packaging. That mismatch is exactly what
#3902 had to clean up, where one
addon's graph ended up running on another addon's backend and aborted the app.

Separately, @qvac/vla-ggml's floor allows 0.20.0, which predates the CPU
SmolVLA mmap fix.

📝 How

Raise six addon floors in packages/sdk/package.json to the releases carrying
qvac-fabric 10069.1.1, and take vla-ggml to its 0.21.1 patch:

Package	Before	After
@qvac/classification-ggml	^0.19.1	^0.20.0
@qvac/embed-llamacpp	^0.33.0	^0.34.0
@qvac/llm-llamacpp	^0.44.0	^0.45.0
@qvac/ocr-ggml	^0.17.0	^0.18.0
@qvac/translation-nmtcpp	^0.9.0	^0.10.0
@qvac/vla-ggml	^0.20.0	^0.21.1

vla-ggml gets the patch version as its floor rather than ^0.21.0. The caret
range would resolve 0.21.1 on a fresh install anyway, but a consumer holding a
lockfile pinned at 0.21.0 would stay there — and 0.21.1 is the fix where CPU
SmolVLA weight loads read the device off the buffer type. ggml declares the CPU
buffer type with no device attached, so every CPU load allocated a private copy
of the model instead of mapping it and charged the whole file (~1.9 GB for the
q8 LIBERO checkpoint) to the process; on iOS that failed the load with a bare
Failed to load SmolVLA model, intermittently and more often later in a long
run.

@qvac/fabric 0.6.0 needs no pin of its own: the SDK never declares it, and
classification-ggml@0.20.0 requires ^0.6.0, so that is what resolves.
@qvac/model-fit is untouched — nothing under packages/sdk references it.
@qvac/tts-ggml stays at main's ^0.7.4.

No source changes. Every changelog entry in the bumped ranges is a fabric bump
explicitly marked "no API change", and #3854 already landed the SDK-side schema
work for image_no_upscale (which needs llm-llamacpp >= 0.44.0, satisfied by
^0.45.0).

🧪 Tested

CI run: https://github.com/tetherto/qvac/actions/runs/32281852430?pr=3952

• Confirmed every target version is published and reachable anonymously on
  registry.npmjs.org (npm view … --userconfig=/dev/null, no NPM_TOKEN) —
  the same visibility SDK Install Check (public npm) asserts.
• Verified @qvac/classification-ggml@0.20.0's published manifest requires
  @qvac/fabric: ^0.6.0, so a fresh install resolves fabric 0.6.0.
• Read every CHANGELOG entry across the six bumped ranges for API or
  behavioral breaks. The only breaking change in range is llm-llamacpp
  0.43.0's tools_compact removal, which predates main's floor and was
  absorbed by #3380.
• Merged current main into the branch. packages/sdk/package.json conflicted
  because QVAC-23075 feat[api]: expose image_no_upscale in the SDK config schema #3854 bumped the same six pins to the 10069.1.0 generation; resolved
  by keeping the higher floor per line and main's tts-ggml ^0.7.4. The net
  diff against main is six lines in one file.
• No install performed, by request.

⚠️ Breaking

None. Floor-only range bumps to already-published versions, with no public API
or behavioral change in the SDK.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — findings detected (warn-only)

Critical: 0 · High: 6 · Medium: 0

Dependency	License	Scope	Severity	Outcome
@qvac/classification-ggml@^0.20.0	(none detected)	runtime	High	blocks
@qvac/embed-llamacpp@^0.34.0	(none detected)	runtime	High	blocks
@qvac/llm-llamacpp@^0.45.0	(none detected)	runtime	High	blocks
@qvac/ocr-ggml@^0.18.0	(none detected)	runtime	High	blocks
@qvac/translation-nmtcpp@^0.10.0	(none detected)	runtime	High	blocks
@qvac/vla-ggml@^0.21.1	(none detected)	runtime	High	blocks

How to resolve a blocking finding:

• Remove or replace the disallowed dependency, or
• If the license is genuinely acceptable, run the compliance SKILL and record the decision in .github/license-allowlist.yml (CODEOWNERS-reviewed), or
• For a one-off, a maintainer can apply the license-override label (High findings only; Critical cannot be overridden).

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[github-actions]

QVAC E2E — windows — ✅ all tests passed (106/106, 426s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

[github-actions]

QVAC E2E — linux — ✅ all tests passed (106/106, 366s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

[github-actions]

QVAC E2E — android — ✅ all tests passed (92/106, 1008s)

Config: suite=smoke · filter=(none) · exclude=(none)
Device pool: Private - Pixel 9 Pro - Android 15 — ⛅ available
View run · Artifacts: reports · Device Farm logs

[github-actions]

QVAC E2E — macos — ✅ all tests passed (106/106, 225s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

[github-actions]

QVAC E2E — ios — ✅ all tests passed (92/106, 429s)

Config: suite=smoke · filter=(none) · exclude=(none)
Device pool: Private - iPhone 16 - iOS 26 — ⛅ available
View run · Artifacts: reports · Device Farm logs