[Priyanshu-u07]

Stage 2 of scripts/airgap_check.sh could never pass. It ran vLLM in the foreground, and since the server never exits, the run could only end in failure. It also defaulted to the stage 1 dummy model, which vLLM cannot serve.

Stage 2 now:

• takes a real model id and stops early if the vLLM image is not already on the host
• checks that the running app has model egress off
• starts vLLM detached on the isolated network, with HF_ENDPOINT pointing at the mirror
• confirms huggingface.co is unreachable from inside the container (a check that could not run is not counted as blocked)
• waits until vLLM serves, reports how long it took, and fails early if the container exits
• sends one completion and requires text back
• prints vLLM's last log lines on any failure; clean removes the container

Verified on a GPU host with Qwen/Qwen2.5-0.5B-Instruct imported: huggingface.co unreachable, vLLM served in 86s through the mirror, completion returned.