[release] Fix huggingface_accelerate release test: floor peft>=0.18 for transformers 5.x

[elliot-barn]

Why are these changes needed?

The huggingface_accelerate nightly release test fails at startup with:

ImportError: cannot import name 'HybridCache' from 'transformers'

Root cause: after the HuggingFace stack upgrade (#64054), the ray-ml
base-extra-testdeps lock pairs transformers==5.11.0 with peft==0.17.1.
peft has no source pin — it is pulled in transitively by lm_eval — so uv
left it at a stale resolution. peft 0.17.x imports HybridCache from
transformers at module scope, but transformers 5.x removed that class, and
transformers' trainer_utils imports peft whenever it is installed, so any
import transformers on the image crashes.

Fix: add a peft>=0.18 floor (0.18 made the HybridCache import lazy and
version-guarded; verified 0.19.1 only references it inside a deferred
Gemma-specific code path) to the ml byod source requirements for both py3.10
and py3.13, and recompile the affected locks:

• python/deplocks/base_extra_testdeps/ray-ml-base_extra_testdeps_py3.10.lock: peft 0.17.1 → 0.19.1 (no other resolution changes)
• release/ray_release/byod/ml_torchft_py3.13.lock: already resolved peft 0.19.1; only picks up the new via annotation

Related issue number

N/A — nightly release-test failure (huggingface_accelerate, Train tests group).

Checks

• I've signed off every commit(by using the -s flag, i.e., git commit -s) in this PR.
• I've run scripts/format.sh to lint the changes in this PR. (pre-commit hooks ran at commit time)
• I've included any doc changes needed for https://docs.ray.io/en/master/.
• I've added any new APIs to the API Reference.
• I've made sure the tests are passing. Note that there might be a few flaky tests, see the recent failures at https://flakey-tests.ray.io/

Testing:

• Locks regenerated with bazel run //ci/raydepsets:raydepsets -- build ci/raydepsets/configs/rayimg.depsets.yaml --name ray_ml_base_extra_testdeps_cuda_310 and ... build ci/raydepsets/configs/release_ml_torchft_tests.depsets.yaml (both compiled successfully; diffs are minimal as described above).
• Verified against the peft 0.19.1 wheel that peft/peft_model.py no longer imports HybridCache at module scope.
• End-to-end verification requires a nightly image rebuild + release-test run of huggingface_accelerate.

AI assistance: this PR was prepared with AI assistance (Claude Code); I reviewed every changed line. Not a duplicate: searched open PRs for peft and huggingface_accelerate — no existing PR addresses this failure.

🤖 Generated with Claude Code

Successful release test run: https://buildkite.com/ray-project/release/builds/102272/canvas

[gemini-code-assist]

Code Review

This pull request updates the peft dependency requirement to >=0.18 in the BYOD ML requirements files (requirements_ml_byod_3.10.in and requirements_ml_byod_3.13.in) and updates the corresponding lockfiles. This change is made to prevent runtime import errors with transformers 5.x due to the removal of HybridCache in older peft versions (0.17.x). I have no feedback to provide.