Rootless ROCm container probe
This verification role pulls one immutable amd64 manifest of the official
llama.cpp server-rocm image into the gnai-testing rootless Podman store.
It verifies the OCI image revision and build version, then runs
rocminfo and llama-server --list-devices in ephemeral containers.
The probe uses the same security-relevant options planned for the permanent
Quadlet: /dev/kfd, only the discovered AMD render nodes and
GroupAdd=keep-groups. It sets no graphics-architecture override, publishes no
port, mounts no model and removes the probe container after execution. The
pinned image remains in the Testing store for the subsequent llama.cpp
deployment.
Success proves that ROCm sees two gfx1030 agents and that llama.cpp exposes
both as usable ROCm devices to the rootless Testing container. It does not yet
prove model loading, multi-GPU splitting or inference.