CPython 3.14.0/3.14.1 fatally crash Ray async actors running on boost
fiber stacks (python/cpython#141944, fixed upstream in 3.14.2), which
kills the JobSupervisor on every Anyscale job. The py3.14 images are
stuck on 3.14.0 for two reasons: the unpinned 'conda install
python=3.14' resolve is frozen in the wanda layer cache, and the
libffi=3.4.6 pin in base-deps forces conda to pick python 3.14.0 even
on a fresh build (newer 3.14.x conda-forge builds require libffi>=3.5).

Pin python 3.14.6 in base-deps and base-slim, and let 3.14 bring its
own libffi. Verified: the async-actor repro crashes in
rayproject/ray:nightly-py314-cpu (3.14.0) and passes with the same
nightly cp314 wheel on 3.14.6.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: elliot-barn <elliot.barnwell@anyscale.com>

CPython 3.14.0/3.14.1 fatally crash Ray async actors running on boost
fiber stacks (python/cpython#141944, fixed upstream in 3.14.2), which
kills the JobSupervisor on every Anyscale job. The py3.14 base image
resolves python 3.14.0 because the exact libffi=3.4.6 pin, installed as
a separate conda step, re-solves the env and downgrades python to the
only 3.14 build compatible with libffi<3.5.

Replace the two-step install with a single solve using a libffi floor
(>=3.4.6, keeping the intent of the original pin): every python version
then resolves its newest patch release with a compatible libffi —
3.14.6 + libffi 3.5.2 for py3.14. Verified via dry-run for 3.10-3.14
and ctypes smoke tests on 3.10 (libffi 3.7.0) and 3.14 (libffi 3.5.2);
the async-actor repro crashes on 3.14.0 and passes with the same
nightly cp314 wheel on 3.14.6.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: elliot-barn <elliot.barnwell@anyscale.com>

…mage resolving CPython 3.14.0 (#64857)

## Description

### Release smoke test
Adds a `hello_world_py314` nightly smoke release test (aws variation
only), mirroring the existing `hello_world_py313` entry:

- `release/ray_release/schema.json` — add `"3.14"` to the `python` enum
(release-test config validation rejects `python: "3.14"` without this).
- `release/ray_release/config.py` — add `"3.14"` to the cpu/cu123 BYOD
python allowlist (the parallel gate the release runner walks).
- `release/release_tests.yaml` — new `hello_world_py314` test, nightly,
`byod: {}`, same `hello_world_compute_config.yaml` as the other
hello_world tests.

The py3.14 `ray-anyscale` release-test images (cpu + cuda) are already
built and published on master via `.buildkite/release/build.rayci.yml`,
so no image plumbing is needed here.

### Base-image fix (what made the smoke test fail)
The first run of this test failed with the JobSupervisor dying at job
startup: `Fatal Python error: _Py_CheckRecursiveCall: Unrecoverable
stack overflow`. Root cause: the py3.14 images ship **CPython 3.14.0**,
which fatally crashes any Ray async actor running on a boost fiber stack
(python/cpython#141944, fixed upstream in **3.14.2**).

Why the images resolve 3.14.0: `docker/base-deps/Dockerfile` installs an
exact `libffi=3.4.6` pin as a *separate* conda step after installing
python. That second solve downgrades python to the only 3.14 build
compatible with `libffi<3.5` — which is 3.14.0. (The stale wanda layer
cache compounds this, but even a fresh rebuild today re-resolves 3.14.0
because of the pin.)

Fix: replace the two-step install with a **single solve using a libffi
floor** (`libffi>=3.4.6`, preserving the intent of the original pin —
the 3.4.2/defaults-channel libffi was buggy). No per-version special
casing; every python version resolves its newest patch release with a
compatible libffi. Resolved versions today: py3.10→3.10.20 (libffi
3.7.0), py3.11→3.11.15, py3.12→3.12.13, py3.13→3.13.14 (libffi 3.5.2),
py3.14→**3.14.6** (libffi 3.5.2). The Dockerfile change also busts the
stale wanda cache.

Note: #64772 (fiber stack-protection re-anchoring) is complementary, not
a fix for this crash — its `PyUnstable_ThreadState_SetStackProtection`
call only exists on 3.14.2+, so it no-ops on the 3.14.0 currently in the
images. Once this lands, #64772 fixes the remaining per-task async-actor
memory leak.

## Verification

- Reproduced the crash: async-actor repro
(`ray.get(A.remote().hi.remote())` with an `async def` method) dies in
`rayproject/ray:nightly-py314-cpu` (CPython 3.14.0) with the exact
failure signature from release-test job
`prodjob_d4dctduzm3h6eu812vrrehiuzl`.
- Verified the fix: the same unpatched nightly cp314 wheel on CPython
3.14.6 (`python:3.14-slim`) runs the repro successfully.
- Verified the combined solve under miniforge 24.11.3-0 (same as the
Dockerfile): dry-runs for python 3.10–3.14 all resolve (versions above),
plus real installs with `ctypes` smoke tests on 3.10 (libffi 3.7.0) and
3.14.6 (libffi 3.5.2).
- `python -m pytest -q release/ray_release/tests/test_config.py` — 23
passed; full collection validates (319 tests) including
`hello_world_py314.aws`.

## Duplicate-work note

#63237 contains an earlier version of the release-test config bundled
with image-build plumbing that has since landed on master through other
PRs. This PR carves out the remaining release-test config plus the
base-image fix; #63237 can be closed or rebased down to the raylet fix.

AI assistance (Claude Code) was used for this PR; all changes reviewed
by the submitter.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: elliot-barn <elliot.barnwell@anyscale.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>