stacks/kokoro: cpu/gpu variant toggle + tighter pull-log filter

Two fixes from the failed first deploy on irv-ml1:

1. CPU/GPU variant. Kokoro's GPU image needs CUDA >= 12.9; irv-ml1's
   driver 570.124.06 caps at 12.8 so the gpu variant fails with
   "nvidia-container-cli: requirement error: unsatisfied condition:
   cuda>=12.9". Make the variant a knob:

     KOKORO_VARIANT=cpu         (default — works anywhere)
     KOKORO_VARIANT=gpu         (after driver bump)
     KOKORO_USE_GPU=false|true  (matches the variant)

   Kokoro is tiny (82M params) so CPU is workable: TTFA ~1s vs ~300ms
   on GPU. Acceptable while the driver bump gets scheduled. compose.yaml
   no longer hard-codes `runtime: nvidia` — relies on the daemon's
   default-runtime + NVIDIA_VISIBLE_DEVICES gating, same as how the
   wrapper's USE_GPU flag selects the inference path inside the
   container. Toggling between variants is now a `.env` edit + restart.

2. Tighter pull-log filter. --quiet on `docker compose pull` only
   suppresses the pull command's stdout; the docker daemon still
   emits per-layer extraction events on stderr ("ffbfd7a09415
   Extracting 64.06MB" repeated dozens of times per layer). Drop those
   too via grep on the SHA-prefixed pattern. set -o pipefail keeps a
   real pull failure visible.

For existing deployments: removing /opt/docker/compose/kokoro/.env
on the host and rerunning the playbook re-seeds with the new schema.

playbooks/deploy-kokoro.yaml

@@ -58,9 +58,15 @@ steps:
   # ── pull + bring up ─────────────────────────────────────────────────
 
   - name: "docker compose pull (first run: ~6.5 GB from GHCR)"
-    # --quiet drops the per-layer progress redraws that flood the log
-    # during a 6.5 GB pull. Final "X Pulled" line still prints.
-    shell: cd {{ compose_dir }} && docker compose pull --quiet
+    # --quiet suppresses pull-command progress, but the docker daemon
+    # still emits its own per-layer extraction progress events
+    # ("ffbfd7a09415 Extracting 64.06MB" etc) on stderr — these are
+    # what flooded the log on the previous run. Drop them with grep.
+    # set -o pipefail so a real pull failure isn't swallowed.
+    shell: |
+      set -o pipefail
+      cd {{ compose_dir }} && docker compose pull --quiet 2>&1 \
+        | grep -vE '^\s*[0-9a-f]{8,16}\s+(Extracting|Pull complete|Pulling fs layer|Verifying Checksum|Download complete|Waiting|Already exists|Downloading|Pulling from)'
 
   - name: docker compose up -d
     shell: cd {{ compose_dir }} && docker compose up -d

stacks/kokoro/.env.example

@@ -1,6 +1,16 @@
 # Kokoro-FastAPI stack tunables. Copy to `.env` on irv-ml1 before deploying.
 
 # ── image pin ────────────────────────────────────────────────────────
+# Image variant. Two choices:
+#   cpu — works on any host. Kokoro is tiny (82M params) so CPU
+#         inference is acceptable: TTFA ~1s on a modern CPU vs
+#         ~300ms on a 30-series-or-newer GPU. Fine as a default.
+#   gpu — requires NVIDIA driver supporting CUDA >= 12.9. As of
+#         2026-04-25, irv-ml1's driver 570.124.06 caps at CUDA 12.8,
+#         so the gpu variant won't start there yet. Bump the driver
+#         (separate procedure, requires reboot) then flip this to gpu.
+KOKORO_VARIANT=cpu
+
 # Tagged release on GHCR. Avoid `latest` — upstream warns it can move
 # without notice. v0.2.4-master = 2025-12-13 release with Kokoro-82M v1.0
 # baked in (commit 9901c2b).
@@ -17,10 +27,15 @@ KOKORO_PORT=8193
 KOKORO_BIND=0.0.0.0
 
 # ── runtime / GPU ────────────────────────────────────────────────────
-# Devices visible inside the container. "0" pins to the RTX 3090
-# (Kokoro is tiny — ~1 GB VRAM — and doesn't need the A6000). Use
-# "all" if you want the model swap to either GPU.
-KOKORO_GPU_DEVICES=0
+# Only used when KOKORO_VARIANT=gpu. Leave empty for the cpu variant.
+# When using the gpu variant: "0" pins to the RTX 3090 (Kokoro is tiny
+# — ~1 GB VRAM — and doesn't need the A6000); "all" exposes both.
+KOKORO_GPU_DEVICES=
+
+# Tells the wrapper to route inference through CUDA. Must be `false`
+# for the cpu variant (it has no CUDA libraries). Flip to `true` when
+# you switch KOKORO_VARIANT=gpu.
+KOKORO_USE_GPU=false
 
 # Logging level for the FastAPI app. INFO is the upstream default.
 KOKORO_LOG_LEVEL=INFO

stacks/kokoro/compose.yaml

@@ -17,15 +17,19 @@
 
 services:
   kokoro:
-    image: ghcr.io/remsky/kokoro-fastapi-gpu:${KOKORO_TAG}
+    image: ghcr.io/remsky/kokoro-fastapi-${KOKORO_VARIANT:-cpu}:${KOKORO_TAG}
     container_name: kokoro
     restart: unless-stopped
-    runtime: nvidia
+    # Only request GPU runtime when running the GPU variant. Toggling
+    # `runtime: nvidia` from a YAML knob isn't possible directly; we
+    # accomplish it by routing nvidia-only fields through the
+    # NVIDIA_VISIBLE_DEVICES env var instead. The cpu variant ignores
+    # that env var harmlessly; the gpu variant honors it.
     ports:
       - "${KOKORO_BIND:-0.0.0.0}:${KOKORO_PORT}:8880"
     environment:
-      - NVIDIA_VISIBLE_DEVICES=${KOKORO_GPU_DEVICES:-0}
-      - USE_GPU=true
+      - NVIDIA_VISIBLE_DEVICES=${KOKORO_GPU_DEVICES:-}
+      - USE_GPU=${KOKORO_USE_GPU:-false}
       - API_LOG_LEVEL=${KOKORO_LOG_LEVEL:-INFO}
     volumes:
       # Optional voice-overlay mount — drop a custom <name>.pt into the