feat(safetensors): native SentencePiece (.model) parser (AU2)

[kekzl]

Summary

Closes audit followup AU2. Older Llama 1/2 and some Mistral SafeTensors checkpoints ship only tokenizer.model (the SentencePiece protobuf), not tokenizer.json. Until now imp's SafeTensors path failed those with an actionable IMP_LOG_ERROR pointing the user at a Python conversion script (PR #116, Phase 2).

This PR replaces the error path with an in-tree native SentencePiece parser. Zero new dependencies — a 250-line wire-format protobuf decoder reads ModelProto directly, extracting the pieces list (vocabulary) + scores + types + TrainerSpec ids. imp's existing SPM-style score-based encoder in tokenizer.cpp:encode_spm() consumes the result via Tokenizer::load_vocab() / load_token_types().

Scope

• Wire-format types 0/1/2/5 supported; unknown fields skipped without error.
• Negative int32 (e.g. pad_id=-1) round-trips through 10-byte sign-extended varints.
• ModelType detection: UNIGRAM / BPE / WORD / CHAR. Vocabulary loads identically; the encoder runs score-based merging that matches Unigram exactly and BPE acceptably for practical text.
• Wired into safetensors_loader.cpp at the existing has_spm branch.

Tests

10 new unit tests in test-core:

• 5 happy paths: pieces+scores, TrainerSpec, ModelType=BPE, unknown-field skip, negative-pad-id round-trip
• 4 reject paths: empty input, no pieces, truncated varint, length-delim past EOF
• 1 integration test against /home/kekz/.cache/huggingface's T5 spiece.model (32k pieces, Unigram, bos=-1 eos=1 unk=2 — matches T5 conventions). Gracefully skips when fixture absent so CI stays portable.

```
[==========] 10 tests from 1 test suite ran. (1 ms total)
[ PASSED ] 10 tests.
```

Full test-core regression: 148/148 → 157/157, no failures.

Quality Gate

• ✅ Numerical correctness: real-world T5 32K-piece vocabulary parses cleanly, ids match T5 conventions
• ✅ No regression: full test-core green
• ✅ No new third-party deps: pure C++17 stdlib + POSIX mmap, no protobuf library, no sentencepiece dep
• ✅ Error paths covered: 4 negative tests for malformed wire format
• ✅ Documentation updated: docs/audit/followups.md, roadmap_inventory_2026-05.md, safetensors_audit.md flip from UNCERTAIN/deferred to closed
• ✅ Root-cause oriented: implements the missing parser instead of papering over the failure

Test plan

• `make build` — Docker build green
• `docker run ... test-core --gtest_filter='SentencePieceLoader.*'` — 10/10 pass with bind-mounted HF cache
• Full test-core regression — 157/157
• Pre-push hook (verify-fast) — PASS, decode within baseline
• CI matrix on push

🤖 Generated with Claude Code