fix(ml,infra): raise eval_softmax_temp floor to 0.1, fix CI sccache TLS

- Raise eval_softmax_temp lower bound from 0.01 to 0.1 (log scale) to
  prevent near-greedy collapse in hyperopt walk-forward eval. Temps below
  0.05 produced degenerate 1-trade trials even with softmax sampling.

- Mount MinIO CA cert in CI compile pods and append to system trust store
  so sccache S3 backend can verify MinIO's self-signed TLS certificate.

- Add openssh-client to ci-builder-cpu Dockerfile (missing, broke git
  clone over SSH).

- Bump MinIO memory limits from 512Mi to 2Gi (OOMKilled under load).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/ml/src/hyperopt/adapters/dqn.rs

@@ -517,8 +517,8 @@ impl ParameterSpace for DQNParams {
             // CQL regularization (1D)
             (0.0, 0.5),         // 25: cql_alpha (linear, 0.0=disabled, 0.1=mild, 0.5=moderate)
 
-            // Eval softmax temperature (1D)
-            (0.01_f64.ln(), 2.0_f64.ln()), // 26: eval_softmax_temp (log scale)
+            // Eval softmax temperature (1D) — floor at 0.1 prevents near-greedy collapse
+            (0.1_f64.ln(), 2.0_f64.ln()), // 26: eval_softmax_temp (log scale)
         ]
     }
 
@@ -3552,7 +3552,7 @@ mod tests {
             256.0,                 // hidden_dim_base min
             0.02,                  // noisy_epsilon_floor min
             0.0,                   // cql_alpha min
-            0.01_f64.ln(),         // eval_softmax_temp min
+            0.1_f64.ln(),          // eval_softmax_temp min
         ];
         let params_min = DQNParams::from_continuous(&continuous_min).unwrap();
         assert!((params_min.per_alpha - 0.4).abs() < 1e-6);