feat: add tabby template

[phala-agent]

Summary

• Adds the tabby prebuilt template for TabbyML/tabby.
• Runs a CPU-safe HTTP verifier/demo on python:3.11-slim-bookworm instead of starting full Tabby inference or downloading model weights.
• Adds templates/icons/tabby.png from upstream ee/tabby-ui/assets/tabby.png at v0.32.0.

Template files

• templates/prebuilt/tabby/docker-compose.yml
• templates/prebuilt/tabby/README.md
• templates/icons/tabby.png
• templates/config.json

Runtime design

• Exposes HTTP port 8080 with /healthz, /demo, and /v1/models.
• Verifies pinned Tabby source/release facts from TABBY_REF (default v0.32.0).
• Does not run tabby serve, download models, load models, request GPU devices, use host bind mounts, or require provider credentials.

Environment variables

• TABBY_REF (optional, default v0.32.0): Tabby release tag, commit, or simple branch ref used for source checks.

Validation

• python3 sdks/templates/validate.py ✅
  • Note: this cron image has /usr/bin/python3 but no python shim.
• git -C sdks diff --check origin/main...HEAD ✅
• docker compose -f sdks/templates/prebuilt/tabby/docker-compose.yml config >/dev/null ✅
• Static audit ✅
  • README deployment/usage/verification coverage present.
  • Config ID unique and repo points to Phala prebuilt path.
  • Icon file exists.
  • No literal secrets, env_file, host bind mounts, external build context, privileged mode, host network, or Docker socket.

Phala Cloud smoke test

• Profile/workspace: hermes-admin-cvm-check / h4x's projects
• Deploy command: phala deploy --profile hermes-admin-cvm-check --name auto-template-test-tabby-0527-052715 --compose sdks/templates/prebuilt/tabby/docker-compose.yml --instance-type tdx.small --wait --no-public-logs --no-public-sysinfo --json
• VM UUID: 46f8d80d-49a0-4fed-b784-62a305074aa3
• App ID: 3471e754ddcbdb0b49a19941116df6e618393926
• phala ps: /dstack-app-1 running and healthy ✅
• HTTP probes on the app endpoint:
  • GET /healthz -> HTTP 200, ok=true, status=ready, errors=0 ✅
  • GET /demo -> HTTP 200, ok=true, cpu_only=true, tabby_server_started=false ✅
  • GET /v1/models -> HTTP 200, object=list, data=[], source_ok=true ✅

Cleanup

• Temporary smoke CVM deleted with phala cvms delete --force ✅
• Follow-up lookup returned not found after deleting ✅

cc @Marvin-Cypher for review.

[phala-agent]

cc @Marvin-Cypher for review.

[Marvin-Cypher]

Reviewed template files, normalized tags, compose config, config validation, stale path cleanup, and compose safety scan. Checks are passing.