ci(hermes): bound voice image memory

ci/Jenkinsfile.hermes-voice-image

@@ -85,8 +85,11 @@ spec:
         runAsUser: 0
         seccompProfile: {type: RuntimeDefault}
       resources:
-        requests: {cpu: 250m, memory: 1Gi, ephemeral-storage: 10Gi}
+        # The STT image snapshots two checksum-pinned Whisper models. A 1 GiB
-        limits: {cpu: "2", memory: 4Gi, ephemeral-storage: 20Gi}
+        # request let the builder overpack titan-20 and a 4 GiB cgroup killed
+        # Kaniko while it emitted the large model layer.
+        requests: {cpu: 250m, memory: 2Gi, ephemeral-storage: 10Gi}
+        limits: {cpu: "2", memory: 6Gi, ephemeral-storage: 20Gi}
 """
     }
   }
@@ -175,6 +178,8 @@ spec:
               /kaniko/executor \
                 --registry-mirror=harbor-core.harbor.svc.cluster.local \
                 --insecure-registry=harbor-core.harbor.svc.cluster.local \
+                --compressed-caching=false \
+                --snapshot-mode=redo \
                 --context="dir://${WORKSPACE}" \
                 --dockerfile="${WORKSPACE}/dockerfiles/Dockerfile.hermes-jetson-${component}" \
                 --destination="${destination}" \

testing/tests/test_hermes_voice_release.py

@@ -28,6 +28,10 @@ def test_voice_pipeline_binds_component_source_digest_and_release() -> None:
     assert 'node-role.kubernetes.io/worker: "true"' not in pipeline
     assert "ephemeral-storage: 10Gi" in pipeline
     assert "ephemeral-storage: 20Gi" in pipeline
+    assert "memory: 2Gi" in pipeline
+    assert "memory: 6Gi" in pipeline
+    assert "--compressed-caching=false" in pipeline
+    assert "--snapshot-mode=redo" in pipeline
     assert "privileged: true" not in pipeline