feat: add deep model preflight to coli doctor

[bherald]

Summary

• add opt-in coli doctor --deep model-container preflight
• scan every safetensors header without reading tensor payloads
• reject duplicate JSON keys or tensor names, unsupported dtypes, invalid or overlapping offsets, and floating-point shape/byte mismatches
• verify filename-declared shard sequences, required core tensors, and an optional model.safetensors.index.json
• check COLI_MODEL_MIRROR with the same file-size and raw-header admission used by the runtime while preserving partial mirrors
• keep standard coli doctor behavior fast and add an additive mode field to the versioned JSON report

This complements the runtime missing-tensor diagnostics merged in #614 by moving broader container and mirror validation ahead of engine startup. Thank you @ZacharyZcR for #614; its diagnostics helped make the preflight boundary clear.

The deep path is bounded to 512 shards and 512 MiB per safetensors header or model index. Shard-sequence accounting remains constant-memory even for malformed numeric suffixes. It does not hash tensor payloads, load the model, start the engine, or initialize an accelerator.

Validation

make check
# native suite passed, including test_uring
# 211 Python tests passed; 13 skipped

PYTHONPATH=c python3 c/tests/test_doctor.py
# 22 tests passed

git diff --check upstream/dev...HEAD
# clean

A read-only field run against a real converted GLM-5.2 model and partial mirror reported:

• 144 primary shards and 118,478 tensors validated
• required core tensors present
• converter shards out-00000 through out-00140 contiguous; tail completeness left undeclared
• 71 mirror shards admitted, 73 absent from the partial mirror, and 0 divergent
• optional model index absent, correctly reported as skipped
• deep container checks passed; the existing placement plan retained its cold-disk-miss warning

Compatibility

• --deep is opt-in
• standard doctor checks and exit semantics remain in place
• JSON schema version remains 1 with the additive mode field and new check IDs
• no new dependency is introduced