#1859 weights: add an opt-in read-only safetensors source (no engine changes)

本文

Original NVIDIA ModelOpt NVFP4 checkpoints cannot currently be consumed as safetensors by Strata's weight-source interface. This first patch provides a read-only source and standalone inspector, ahead of model/layout and runtime integration. It is related to #1858; the complete experimental implementation and its measured limits are linked there.

The source validates the index and all shard headers, retains physical shapes and absolute byte ranges, performs bounded coalesced reads into caller-owned spans, accounts for bytes by family, and can seal expert/MTP reads or close all resident startup handles. It rejects malformed descriptors, duplicate JSON keys, unsafe paths, index mismatches and out-of-bounds reads. nlohmann/json 3.12.0 is vendored with its MIT license and hash; configuration downloads nothing.

This is explicitly opt-in through `cmake -S native_safetensors ...`. All 12 changed paths are additions. The root CMake file, every existing engine/backend/setup file, CLI and runtime default are unchanged byte-for-byte against the tested upstream baseline `fb58e0dbc8399662c0e47c76578c6e878b14f6cf`. No complete inference or speed improvement is claimed by this patch; NVFP4 layout binding, CUDA execution, scheduling and server integration are separate follow-ups.

Validation on Windows, MSVC 19.44.35228 / Python 3.13.15:

- Standalone Release and Debug builds pass with `/W4 /WX`; CTest passes 2/2 in each configuration.
- The C++ fixture verifies scatter/coalescing, family counters, descriptor ownership, validation-before-I/O, sealing and reuse of owned sample bytes.
- Python runs 12 adversarial/container tests: 11 pass and the symlink-escape fixture is skipped because the account lacks Windows symlink privileges. The sparse >4 GiB seek test passes.
- The Release inspector parses the original checkpoint's 11 shards / 299,545 tensors, reading 40,402,984 header bytes with every payload-family counter zero.

No CUDA, HIP or SYCL backend files are touched or built. Linux execution has not been validated. Build commands, behavior and limitations are documented in `docs/SAFETENSORS_SOURCE.md`.