fix(scriberr): diarization works again: HF_TOKEN passthrough, pyannote env torchcodec pin (patch 0003); mirror retention; YaRN stays off

Scriberr: pyannote's diarization models are gated, and Scriberr had no Hugging
Face token, so every diarized job died at the diarize step (WhisperX after a full
CPU transcription). HF_TOKEN now passes through compose; the value is only in the
host .env (vault fv-ml1/hf-token). The separate pyannote env had torchcodec 0.16
(needs torch >=2.11/CUDA 13) beside torch 2.8, so pyannote 4 had no
AudioDecoder. Pinned to 0.7 by hand on the live env; patch 0003 makes it
durable at the next rebuild. WhisperX's adapter defaults to cpu/small/float32,
now documented. Both paths verified on GPU 3 with a real multi-speaker clip.

pbs-nh3: the backups-mirror prune job now keeps the primary's history
(last 3, daily 14, weekly 8, monthly 12, yearly 5). Dry-run: keep 738,
remove 3,194 across 32 groups; first run at the job's 00:00.

stacks/scriberr/compose.yaml

@@ -72,6 +72,15 @@ services:
       # and takes out the Parakeet + Sortformer backends (WhisperX survives).
       # `copy` trades a little disk and time for it actually working.
       - UV_LINK_MODE=${SCRIBERR_UV_LINK_MODE:-copy}
+      # Hugging Face token for the GATED pyannote models (speaker-diarization-3.1,
+      # segmentation-3.0). Without it every diarized job dies at the diarize step:
+      # WhisperX with a 401 GatedRepoError AFTER the whole transcription has run, and
+      # Parakeet+pyannote with "HuggingFace token is required". So it looks as if
+      # nothing works. Scriberr's config and both adapters read HF_TOKEN
+      # (internal/config/config.go), and it reaches the uv subprocesses. Value: vault
+      # `fv-ml1/hf-token` (account lkraven, read role; access to the gated repos was
+      # checked 2026-10-06). It lives only in the host .env, never in git.
+      - HF_TOKEN=${HF_TOKEN:-}
       # ── Memory settings, measured while Scriberr shared GPU 1 (2026-09-30; it moved to
       # GPU 3 at 1322 the same day, so the 5.5 GB budget no longer binds, but the values stand). Prime: Scriberr shared GPU 1 with
       # intern-decision, which holds ~9.7 GB resting / 10.3 GB peak). ──────────