build(deps): upgrade transformers to 5.18

[jason-fxz]

Summary

Upgrade transformers 5.16 -> 5.18. The main gain is GGUF tokenizers: 5.18 registers a GGUF's USER_DEFINED and CONTROL tokens, so <think>, <tool_call> and similar tokens are no longer split (the Flash-Next GGUF split <think> into 3 tokens).

Changes

1. GGUF tokenizer (models/gguf/tokenizer.py), now a thin layer over transformers:
   • Built with get_gguf_tokenizer + convert_gguf_tokenizer, the tokenizer half of AutoTokenizer.from_pretrained(gguf_file=...). The other half builds a model config, which needs the PyPI gguf package and does not know qwen4exp.
   • Special tokens are the ones the file declares. Before, a file without unknown_token_id (Flash-Next) got a new <unk> with id 248320, past the vocabulary.
   • Where a GGUF has no HF equivalent, follow llama.cpp:
     • Stop ids: the file's eos / eot / eom plus the tokens named in llama.cpp's end-of-generation list. Flash-Next gains <|endoftext|> and Gemma-4 gains <|tool_response>, matching their HF generation configs.
     • BOS / EOS on raw prompts: tokenizer.ggml.add_bos_token / add_eos_token. Chat requests are not affected.
2. 5.18 renamed qwen_sparse_attention and deepseek_sparse_attention to indexed_attention:
   • qwen4_exp: Flash-Next (HF) silently lost its 12 index layers; now mapped to full attention.
   • glm5_next: GLM-5.3-Flash raised on the new name; load_args now remaps legacy names and expects indexed_attention.
3. Tests: test_dsa_kpool uses the new name; test_glm_dsa passes an explicit causal mask to the HF indexer reference, which 5.18 requires.

Validation

• GPU A/B on an H100, AIME25 problem 1, greedy, main on 5.16 vs this branch:
  • Gemma-4 26B-A4B Q4_0 GGUF (fused), Qwen3.5-2B, Flash-Next NVFP4 HF (offload): identical tokens.
  • Flash-Next IQ3_XXS GGUF (fused): prompt 98 -> 96 tokens, now equal to the HF tokenizer's; run to EOS, both answer 70.
• GGUF vs HF tokenizer of the same model: Flash-Next and five Gemma-4 GGUFs match on encodings, chat-template ids and stop ids. Of 28 other GGUFs from the Hub, 14 match exactly; the rest differ through gaps in transformers' GGUF converter (missing pre-tokenizer regexes such as glm4, deepseek-v3).
• Other registered architectures (37 local checkpoints, config-only for the rest; Mistral3 fails to parse on both versions): parsed config, tokenization and image preprocessing unchanged between 5.16 and 5.18.
• Unit tests: 2124 passed; 1 failure (test_quant_config apodex index-only) also fails on main.