fix: pin model revisions and quarantine MariaDB CI routing

tools/summarizer/app.py

@@ -94,6 +94,8 @@ async def require_service_token(request: Request, call_next):
         _external_ai_allowed.reset(allowed_token)
 
 MODEL_NAME = "sshleifer/distilbart-cnn-12-6"
+# Keep tokenizer and weights on the same reviewed immutable upstream snapshot.
+MODEL_REVISION = "a4f8f3ea906ed274767e9906dbaede7531d660ff"
 MAX_INPUT_CHARS = 20000
 MAX_CONTEXT_CHARS = 2200
 MAX_EXTRACT_FILE_BYTES = 5 * 1024 * 1024
@@ -159,8 +161,8 @@ MODEL_DISABLED = SKIP_MODEL_LOAD
 
 
 def _load_runtime():
-    tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME)
-    model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME)
+    tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False)
+    model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, weights_only=True)
     model.eval()
     has_cuda = torch.cuda.is_available()
     device = torch.device("cuda" if has_cuda else "cpu")