fix(tts): bound temp storage and worker memory

[danaucpe]

Summary

• upgrade Kokoro FastAPI CPU from v0.2.4 to v0.8.0, which includes the upstream voice-tensor memory-leak fix
• default to one Uvicorn worker under the existing 4 GiB limit
• mount /tmp as a bounded 512 MiB tmpfs so transient Kokoro/PyTorch/espeak files cannot grow Docker.raw indefinitely
• retain exec on /tmp because phonemizer loads its private libespeak-ng.so copy there
• document the operational controls and correct the voices endpoint

Runtime evidence

Observed on Apple Silicon with the existing v0.2.4 service:

• 3,941 Child process died events and 3,617 pipeline recreations
• 75,134 stale /tmp/tmp* entries consumed 27.20 GiB in the container writable layer

Validated the patched v0.8.0 service:

• container healthy with one worker, 4 GiB memory limit, and /tmp mounted as exec,size=512m,mode=1777
• real WAV synthesis passed (24 kHz, mono PCM)
• 20 concurrent synthesis requests: 20 successes, 0 failures
• /tmp remained effectively flat (2,892 KiB to 2,908 KiB by du)
• restart count remained 0; no OOM or unhealthy state

Tests

• docker compose ... config --quiet
• focused YAML contract assertions passed
• bash -n ods/tests/contracts/test-installer-contracts.sh
• full installer contract suite reached and passed the new TTS assertions, then failed later in the pre-existing bootstrap hot-swap test with sed: -e: No such file or directory / Hermes live patch helper rejected metacharacters on macOS.