voxtral + kyutai-tts: fix wrong image tag / wrong endpoint paths; fish-s2: env-selectable model variant

Three fixes from the second-wave deploy attempts:

* voxtral: vllm/vllm-omni doesn't publish a `latest` tag — pull
  failed with "manifest unknown". Pinned VOXTRAL_VLLM_TAG to v0.18.0
  (released 2026-03-29, the day after the Voxtral 4B TTS release —
  first cut with Voxtral support).

* kyutai-tts: NillPointer wrapper exposes ONLY /health (root) and
  POST /v1/audio/speech. No /v1/models, no /v1/audio/voices —
  those return 404. Verified by /openapi.json against the live
  container. Compose healthcheck + playbook wait + verify steps
  all repointed at the actual paths. POST /v1/audio/speech is now
  smoke-tested with a RIFF WAV assertion (same pattern as fish-s2).

* fish-s2: added FISH_S2_MODEL env var so the model variant is
  swappable via .env without rebuilding. Both s2-pro (default) and
  s1-mini are pre-pulled into the bind-mount; LLAMA_CHECKPOINT_PATH
  + DECODER_CHECKPOINT_PATH now use ${FISH_S2_MODEL:-s2-pro}.
  s1-mini was originally gated on fishaudio's HF org (401), but
  niobures/OpenAudio-S1 mirrors the same files openly — pulled
  from there via a one-shot snapshot_download.

stacks/kyutai-tts/compose.yaml

@@ -39,10 +39,12 @@ services:
       - ${KYUTAI_TTS_CACHE_DIR}:/app/hf_cache
       - ${KYUTAI_TTS_VOICES_DIR}:/app/voices:ro
     healthcheck:
-      # The wrapper exposes /v1/models for OpenAI-compat — same shape
-      # as Voxtral / Qwen3-TTS. Use that as the readiness signal.
-      # 127.0.0.1 explicit to dodge IPv4/IPv6 localhost race.
-      test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/v1/models', timeout=5).status==200 else 1)\""]
+      # NillPointer wrapper's actual endpoints (verified at runtime via
+      # /openapi.json): just /health (root) and /v1/audio/speech (POST).
+      # No /v1/models, no /v1/audio/voices — those 404. /health is the
+      # liveness signal. 127.0.0.1 explicit to dodge IPv4/IPv6 localhost
+      # race.
+      test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).status==200 else 1)\""]
       interval: 30s
       timeout: 10s
       retries: 3