feat(worker): open the ModelScope ModelArtifact source end to end

[thxCode]

What type of PR is this?

/kind enhancement
/kind api-change
/area worker
/area testing

What this PR does / why we need it:

Opens the modelScope source of ModelArtifact end to end. The API has carried a reserved
modelScope member since the Hugging Face spec with admission refusing it; this PR implements
what opening it needs and turns the member on, at behavior parity with the Hugging Face source,
with the three ModelScope-specific failure modes handled so none of them can silently deliver
wrong content.

• Admission accepts the member with the same repository and revision rules as Hugging Face
  (the hub source shape is shared), defaults an unset revision to master, and makes
  allowPatterns / ignorePatterns legal on a ModelScope source.
• Resolution (controller) pins an immutable commit and a manifest digest:
  • A non-commit revision resolves through commits?Ref=<rev> and is cross-checked against the
    repository's own git endpoint — the HTTP smart-protocol ref advertisement, answered by the
    operator in process (no git binary, no subprocess). A disagreement between the hub's index
    and its git fails as SourceUnavailable.
  • The listing recovers from the API's silent 3000-entry truncation by re-listing per directory
    (Root=<dir>, descending only into subtrees that came back truncated), and refuses a
    directory with 3000 or more direct children rather than ship a partial manifest.
  • Errors classify by the envelope Code (ModelScope reports every access failure as 404) into
    RevisionNotFound / AccessDenied / SourceUnavailable; revalidation is a single HEAD
    and follows the same confirm-then-revoke staircase as Hugging Face.
• Node delivery (plugin): the materializer picks a ModelScope client by the source's kind
  (read from the artifact, volume attributes unchanged); file URLs 302 to a content-addressed
  CDN that honors byte ranges, every file verifies against its manifest sha256 while
  streaming. NodeModelStoreHub gains an optional modelScopeEndpoint (the one API change); a
  ModelScope artifact on a node whose configuration predates the field is refused with a message
  naming the worker upgrade, never resolved against the wrong hub.
• Engine delivery: vLLM and SGLang render their measured switches
  (VLLM_USE_MODELSCOPE / SGLANG_USE_MODELSCOPE, shared MODELSCOPE_CACHE, a token as
  MODELSCOPE_API_TOKEN from the artifact's Secret, and MODELSCOPE_DOMAIN as the bare host
  derived from the endpoint Setting). The runner ModelScope SDK floor (≥ 1.39.1, which accepts a
  commit as the revision) is documented, not enforced — measured: the current CUDA vLLM runner
  lines carry 1.37.1, the Ascend vLLM line and SGLang 0.5.18 runners meet the floor, and a user
  can always name a runner image of their own.
• Free behaviors: everything downstream keys on the manifest digest, so peer sync, progress
  aggregation, prefetch and the placement preference work for a ModelScope artifact with no new
  code; e2e proves the peer-sync leg.
• Docs & configuration: the artifact page owns the source (reason-table rows, the
  cross-check, the truncation recovery, all-sha256 manifests with cross-hub digests
  incomparable, the engine env table, the runner SDK floor); docs/settings.md gains
  model-artifact-modelscope-endpoint (default https://www.modelscope.cn).

Which issue(s) this PR links to:

None

Special notes for your reviewer:

• e2e on kind (v1.29.14, three nodes): case-113 (the ModelScope source case, five legs,
  including peer sync between nodes) and case-97's moved admission rows (23 PASS) are green;
  evidence lives in the task directory.
• Chart case-1 green; make lint, make lint docs, check-docs, check-specs, check-agents-shell
  and the full unit-test set green; generated code verified with zero diff in a clean checkout.
• Known measured limit, stated in the docs: a ModelScope private repository with a valid token
  but no grant maps to AccessDenied with the shared "does not exist or is not accessible"
  message — distinguishing it needs a second ModelScope account, which the test environment does
  not have.

Does this PR introduce a user-facing change?

ModelArtifact gains a `modelScope` source: weights hosted on ModelScope resolve to an immutable
commit and a verified manifest, deliver to nodes through the same cache chain as Hugging Face
(including peer sync), and render for vLLM and SGLang engines. Engine delivery requires a runner
image whose bundled ModelScope SDK is ≥ 1.39.1 — the documentation lists which measured runners
meet the floor today and how to name your own.

[gpustack-code-review]

✅ OpenCodeReview: Review complete: 0 finding(s) across 3 selected item(s).

Reviewed eb36be7..377aaea only; earlier commits in this PR were reviewed in a previous run.

[thxCode]

Round-1 disposition of the summary-routed findings (fixes in dcefedd):

1. report.go L208 — unknown kinds resolved as Hugging Face — Fixed. default now refuses an unrecognized kind (including the empty kind a non-hub source would carry) as InvalidRequest naming it; only HubHuggingFace resolves as Hugging Face. Test: TestEnvironmentRejectsAnUnknownKind.

2. model_artifact.go L141 — hub construction before the Secret checks — Kept as is. The construction costs two in-memory Setting reads plus a ConfigMap GET only when a CA bundle is configured; the Secret check runs first thing inside reconcileHubSource, and the wasted work happens only on the rare missing-Secret path, which is paced by the unavailable retry. Moving construction below the checks would split hub construction from the staircase that owns it for that marginal path.

3. node_model_store.go — regenerated output must ship with the field — Already satisfied. The generated deepcopy, protobuf, CRD, openapi and applyconfiguration output ships in the same commit as the field (49c7568), replayed in the private gen tree with zero drift.

4. value.go L442 — the warm-up image default moves in an otherwise-scoped PR — Intentional, coordinator-directed. The mirrored default makes the image pullable in clusters without Docker Hub access, the same pattern as the other mirrored-* defaults; the Setting remains for clusters with their own registry arrangement. Happy to split it into its own PR if you prefer it isolated.

5. modelscope.go L378 — gitURL drops the endpoint's path prefix — Fixed. The endpoint's path is kept (https://git.example.com/ms → /ms/qwen/repo.git). Test: TestModelScopeGitURLKeepsTheEndpointPath.