build(deps): bump vLLM to 0.26.0 and make the pin real

[rominf]

Summary

Two changes to the vLLM install path in engines/vllm:

• Bump the pinned vLLM release from 0.23.0 to 0.26.0 (published 2026-07-27). 0.26.0 brings support for additional model architectures over 0.23.0.
• Pass an exact requirement to uv pip install instead of a bare package name, on every path including the index override. This is the more important half of the change.

The install was not actually pinned

The install pushed a bare vllm argument into the uv pip install invocation. The only thing constraining the release was the version segment of the ROCm wheel index URL (https://wheels.vllm.ai/rocm/<version>/<abi>). That is not a pin:

• if the index ever serves more than one version under that path, the resolver is free to pick any of them;
• if no wheel under that path matches the interpreter, the resolver falls back to PyPI (--extra-index-url keeps PyPI in play by design, because vLLM's dependencies need it) and installs a generic build.

The second case is not hypothetical — resolving bare vllm against the ROCm index on a CPython 3.13 host (the ROCm wheels are cp312) yields plain vllm==0.26.0 from PyPI rather than the ROCm build.

The install now requests vllm==0.26.0+rocm723 explicitly, so a mismatch fails loudly instead of installing something else.

ABI tag

The ROCm ABI tag stays rocm723. The variant has shifted between releases in the past, so this was the main risk in the bump. Resolving against the live index confirms rocm723 is published for 0.26.0, while neighbouring variants such as rocm724 and rocm730 are not:

$ uv pip compile r724.txt --python-version 3.12 \
    --extra-index-url https://wheels.vllm.ai/rocm/0.26.0/rocm724 \
    --index-strategy unsafe-best-match --no-deps
  x No solution found when resolving dependencies:
  `-> Because there is no version of vllm==0.26.0+rocm724 [...]

The override stays pinned

ROCM_CLI_VLLM_ROCM_INDEX_URL selects a different vLLM/ROCm combination without rebuilding, and a hardcoded vllm==0.26.0+rocm723 cannot resolve against an index serving some other release. The fix is to keep the requirement in lockstep with the index rather than dropping it — an unpinned override is exactly the PyPI-fallback hazard this PR exists to remove.

Version and ABI are treated as the single source of truth from which both the URL and the requirement derive:

• Not set — the built-in index and vllm==0.26.0+rocm723.
• Set to a published release index (https://wheels.vllm.ai/rocm/<version>/<abi>) — the version and ABI are parsed back out of the URL and the requirement becomes vllm==<version>+<abi>. Pointing at a different release of the same index therefore works and stays pinned, with no extra configuration.
• Set to anything else — the build cannot be determined, so the install fails with an error quoting the URL and the expected shape, rather than silently unpinning. A clear failure beats quietly installing the wrong artifact.

Non-goals

• Deriving the ABI tag from the detected ROCm runtime rather than hardcoding it is a separate change that rewrites the same line; it is deliberately not folded in here.
• An explicit version/build override variable, for indexes that do not follow the published path shape, is deliberately left out: a repo-wide change is moving every engine version pin into one config file with a generated override variable per dependency, and vLLM will adopt that convention rather than introduce a one-off variable now.
• Opting into the rolling top-level index (https://wheels.vllm.ai/rocm/, which is latest-only) is out of scope — it is rejected here precisely because it is not a pin.

Test plan

Verified against the live index with uv:

$ uv pip compile req.txt --python-version 3.12 \
    --extra-index-url https://wheels.vllm.ai/rocm/0.26.0/rocm723 \
    --index-strategy unsafe-best-match --no-deps
Resolved 1 package in 12ms
vllm==0.26.0+rocm723

Both the bare vllm requirement and the exact vllm==0.26.0+rocm723 spec resolve to the same wheel, confirming the new index path and ABI tag exist and are self-consistent.

Unit tests cover the resolution rules as pure functions taking the environment value as a parameter (nothing touches process env): nothing set, empty/whitespace values, an override of the published shape (with and without a trailing slash), and overrides that must error rather than unpin — a foreign host, the rolling top-level index, a missing ABI segment, an empty version segment, and a malformed segment.

Local checks: cargo test --workspace --all-targets, cargo clippy --workspace --all-targets -- -D warnings, cargo clippy --locked -p e2e-cucumber --test e2e -- -D warnings, and cargo fmt --all --check all pass. (Two rocm-core proc_lifecycle tests fail on my machine both with and without this change — a local process-group sandboxing artifact, unrelated to this diff.)

Verification gap — please read

This change is weakly covered by automated testing, and honesty about that is more useful than a green checkmark:

• No test asserts that either literal is correct — the tests compare against the constants, so they stay green regardless of what the constants say. vllm_pinned_spec_matches_extra_index_url does assert the two literals agree with each other (it parses the version and ABI tag back out of the spec and requires the index path to end with them), so a half-finished bump fails in CI; it cannot tell whether the pair is published upstream.
• Nothing in default CI fetches the index.

A typo in either string therefore stays green all the way through CI and only surfaces on a real install against a GPU runner. The uv pip compile runs above are the actual verification for this PR.

Risk

Low for the pin itself (a bad string now fails the install loudly rather than installing the wrong build). The override path can now fail where it previously proceeded — that is intentional: it only fails for a URL whose build cannot be determined, where the alternative was installing an unpinned, possibly non-ROCm build. Medium for the version bump, in the ordinary sense that a new vLLM release can change runtime behavior — that surface is not exercised by this repo's default CI.