feat(moe): stream split multi-shard ggufs natively + DeepSeek V4 Flash recipe (#144)

* feat(moe): stream split multi-shard ggufs natively + DeepSeek V4 Flash recipe

Hugging Face rejects single files above 50 GB, so every large model ships as
-00001-of-0000N.gguf shards; until now the streamer assumed one file, forcing
a merge with double the disk. gguf_offsets now fans the first shard out to the
whole set and resolves every tensor to (shard, offset); the expert streamer
and the dense loader open one positioned reader per shard and route each read
by the tensor's shard index. Pass the first shard, exactly as llama.cpp takes
it; a missing sibling fails the load with the shard named.

Add the deepseek4 recipe row: V3.2-style routing (256 routed experts, a
per-expert bias like lfm2moe, an always-on shared expert that stays resident)
over the standard split expert suffixes. The V4 compressed-attention machinery
is dense-side llama.cpp code, invisible to the streaming seam.

The byte-identity gates gain a 4-shard qwen3moe fixture (metadata-only first
shard, the layout large quants actually use); make-tiny-moe.py learns
--split-max-tensors. All gates pass, split included.

* fix(moe): cache auto must budget for the anon dense conversion

The auto budget read MemAvailable while the dense weights were still reclaimable
page cache, then dense-weights=anon converted them into buffers the kernel cannot
take back: the same bytes planned twice. Latent since the anon policy shipped
(dense sets were 2-3 GiB and explicit budgets were the benched path); DeepSeek V4
Flash's 6.5 GiB dense set turned it into a device-taking overcommit on first load.
The budget now deducts the pending conversion and says so in the log.

* fix(moe): review pass on the multi-shard path

Three defects the split rewrite introduced, none of which the gates could see:

- The shard index rode in an int8_t, so a model past 127 shards wrapped to a
  negative index into the reader vector. The bounds check could never catch it:
  it validated the untruncated value. Widened to int16_t, which covers the whole
  -%05d-of-%05d filename space.
- DenseWeights::warm() reused one flag as both the inner loop condition and the
  partial-warm report, so the first shard that failed to open silently skipped
  the warm-up of every later shard. Per-shard condition, sticky report.
- The dense readers stayed allocated for the session after read_anonymous had
  copied and rebound every tensor: fds and a per-lane bounce buffer per shard,
  sitting next to a cache counting every MiB. Released at the end of init.

Also: the streaming banner read O_DIRECT off shard 0, which under the
small-first-shard layout is metadata only and too short to verify, so it could
claim a mode the shards carrying experts had not got. It now reports the weakest
of the readers.

* build: the engine version says 0.19.0, like the changelog does

The version is declared in CMakeLists.txt and reported by `--version` and by the
run-parameter preamble of every metrics CSV, so a committed benchmark file names
the engine that produced it. This release section landed while the number stayed
at 0.18.0, which would have stamped the wrong engine on every CSV this branch
produces, defeating the one purpose the string has.

scripts/make-tiny-moe.py

@@ -87,11 +87,29 @@ def add_attn_tensors(w, p, s):
 
 
 # --- qwen3moe: split expert layout -------------------------------------------------
-def build_qwen3moe(out):
+def make_writer(out, arch, split_max_tensors):
+    """A plain writer, or a sharding one when --split-max-tensors is set.
+
+    Sharded output mirrors how real >50 GB models arrive from Hugging Face: the writer
+    emits <out>-%05d-of-%05d.gguf siblings, with a metadata-only first shard
+    (small_first_shard, the layout unsloth ships). The byte-identity gates then prove the
+    multi-shard streaming path against the same tensors the single-file fixture uses.
+    """
+    if not split_max_tensors:
+        return gguf.GGUFWriter(out, arch)
+    try:
+        return gguf.GGUFWriter(out, arch,
+                               split_max_tensors=split_max_tensors,
+                               small_first_shard=True)
+    except TypeError:
+        raise SystemExit("this gguf package cannot write split files: pip install -U gguf")
+
+
+def build_qwen3moe(out, split_max_tensors=0):
     tokens, scores, toktypes = build_vocab()
     n_vocab = len(tokens)
 
-    w = gguf.GGUFWriter(out, "qwen3moe")
+    w = make_writer(out, "qwen3moe", split_max_tensors)
     w.add_name("tiny-moe")
     w.add_context_length(N_CTX)
     w.add_embedding_length(N_EMBD)
@@ -223,12 +241,16 @@ def main():
     ap = argparse.ArgumentParser()
     ap.add_argument("--arch", choices=["qwen3moe", "gemma4"], default="qwen3moe")
     ap.add_argument("--out", default="tiny-moe.gguf")
+    ap.add_argument("--split-max-tensors", type=int, default=0,
+                    help="emit a sharded gguf (N tensors per shard, metadata-only first shard)")
     args = ap.parse_args()
 
     if args.arch == "gemma4":
+        if args.split_max_tensors:
+            raise SystemExit("--split-max-tensors is exercised via the qwen3moe fixture only")
         build_gemma4(args.out)
     else:
-        build_qwen3moe(args.out)
+        build_qwen3moe(args.out, args.split_max_tensors)
 
 
 if __name__ == "__main__":