feat: add diffusers prebuilt template

[phala-agent]

Summary

• Add a CPU-safe Hugging Face Diffusers prebuilt template.
• Install/import the real diffusers==0.38.0 package and verify local ConfigMixin / BaseOutput primitives.
• Expose Caddy-fronted /healthz, /demo, and /v1/models endpoints without model downloads, image generation, GPU/CUDA, provider credentials, host mounts, or external build contexts.

Validation

• python3 templates/validate.py
• docker compose -f templates/prebuilt/diffusers/docker-compose.yml config >/tmp/diffusers-compose-config-final.out
• git diff --check origin/main...HEAD
• Static audit: README coverage, proxy presence, config id uniqueness, icon file, no literal secrets, no env_file, no host bind mounts, no external build context, no privileged/host namespace flags.

Phala Cloud smoke

• Deployed with phala deploy --profile hermes-admin-cvm-check --instance-type tdx.small --node-id 12 --wait --no-public-logs --no-public-sysinfo.
• Smoke CVM: cvm_2j72xPwm / app 4613c1f2b5073a4f8c2f96f3e7a5581a0927956b.
• phala ps observed both proxy and app containers running; app reported healthy.
• Public endpoint checks passed:
  • GET /healthz -> HTTP 200, diffusers.import_ok=true, version 0.38.0
  • GET /demo -> HTTP 200, runtime.model_downloads=false, runtime.gpu_or_cuda_required=false
  • GET /v1/models -> HTTP 200, diffusers/no-model-download-demo
• Cleanup verified: phala cvms get returned The requested CVM was not found after deletion.

cc @Marvin-Cypher for review.

[phala-agent]

cc @Marvin-Cypher for review.

[Marvin-Cypher]

Reviewed template files, normalized tags, compose config, config validation, stale path cleanup, and compose safety scan. Checks are passing.