Keep gguflib input-validation asserts active in release builds

[qflen]

Summary

Fixes the GGUF out-of-bounds read reported in #3358, using the CMake-based approach suggested in the #3359 review thread (force-enable all gguflib asserts) rather than disabling them.

Why

gguflib relies on assert() to validate untrusted tensor headers: notably assert(tensor->ndim <= GGUF_TENSOR_MAX_DIM) in gguflib.c. Release builds define NDEBUG, so that assert compiles to a no-op and a crafted GGUF with ndim > 8 lets gguflib write past the fixed 8-element dim[] array into offset / bsize / weights_data / the caller's stack frame, after which MLX's get_shape() reads the same range and downstream code dereferences the attacker-controlled weights_data pointer.

The earlier PR #3359 attempted to address this with target_compile_definitions(gguflib PRIVATE NDEBUG), which defines NDEBUG instead of undefining it — so the asserts remained disabled. This PR uses -UNDEBUG to keep them live.

Changes

• mlx/io/CMakeLists.txt: target_compile_options(gguflib PRIVATE -UNDEBUG) so gguflib's existing input-validation asserts stay in every build configuration.
• mlx/io/gguf.cpp: defensive ndim > GGUF_TENSOR_MAX_DIM check in get_shape() as defense-in-depth for packagers that link a system gguflib or otherwise strip asserts.
• tests/load_tests.cpp + tests/CMakeLists.txt: new TEST_CASE exercising the defensive get_shape() check; guarded by MLX_BUILD_GGUF and pulls the gguflib include path in via FetchContent_GetProperties.

Notes

• The test covers the defensive MLX-side check directly (constructs a gguf_tensor with ndim = GGUF_TENSOR_MAX_DIM + 1 and expects std::runtime_error). The primary fix — gguflib's own assert() firing on malformed input — can't be covered by a doctest CHECK_* because it triggers abort(). I can add a death-style or subprocess test on request.
• Upstream fix in Replace assert() with runtime check for tensor ndim bounds antirez/gguf-tools#22 is still the right long-term path; this change just ensures MLX isn't exposed while that sits.

Checklist

• Read the CONTRIBUTING document.
• Ran pre-commit run --all-files against the four changed files; clang-format and cmake-format passed.
• Added a unit test for the defensive get_shape() bounds check in tests/load_tests.cpp. The primary gguflib abort() path is not covered — see Notes.
• No user-facing documentation changes; MLX has no public docs page on GGUF internals that this touches.

[zcbenz]

Thanks for continuing the work! I think you are doing the right fix in this PR.

[zcbenz]

Thanks!