[NV-sschneider]

Changelog title

Choose ModelScope for llama.cpp model downloads

Changelog body

• Select Hugging Face or ModelScope in llama.cpp Settings. The saved choice controls model browsing, search, and downloads on that device; Hugging Face remains the default.

Bumps

• services: minor
• nvpair-cluster-manager: none
• nvpair-engine-manager: minor
• nvpair-errors: none
• nvpair-job-scheduler: none
• nvpair-manual-nodes: none
• nvpair-node-info: none
• nvpair-node-scanner: none
• nvpair-node-settings: none
• nvpair-proxy: none
• nvpair-tui: patch
• nvpair-ui-broker: minor
• nvpair-workload-manager: none

Summary

Add a Model download source dropdown to llama.cpp Settings, with Hugging Face as the default and ModelScope as an alternative. The choice uses the existing preview, Apply, restart, persistence, and remote-settings flow.

The pinned llama.cpp downloader understands Hugging Face metadata. A Go loopback adapter translates ModelScope metadata and streams files while llama.cpp retains GGUF selection, caching, progress, and cancellation. The model browser and search use the selected source with separate caches. No dependencies are added.

Review guide

Review the four signed-off commits oldest first; each commit message includes a detailed guide and focused test commands.

1. c87a529: start with services/nvpair-engine-manager/modelscope.go and its tests. Check immutable revisions, file-list limits, range/cancellation behavior, and credential isolation.
2. c277c92: follow shared settings through the engine manager and broker. Check defaults, persistence/reload, source-only restart decisions, stopped-engine behavior, and Windows environment key casing.
3. 4c41334: start with modelscope_catalog.go, then the source selection in catalog.go and manager.go. Check existing model filters, bounded requests, and provider-specific caches.
4. eef90e5: start with EngineSettingsSection.tsx, then desktop types and the settings bridge. Check llama.cpp-only visibility and the existing draft/preview/Apply flow.

Test plan

Local verification on Windows x64:

Desktop gates passed: 26 Node tests and 285 Vitest tests passed, with two Unix-only cases skipped. Lint, typecheck, dead-code, contract, build-script, and SPDX checks passed.

The Electron production build and all 13 bundled Windows x64 executables built successfully. Broker, TUI, and shared-settings suites passed. All ModelScope and ModelSource tests, including the real-worker settings rebind/reload test, passed.

• node scripts/spdx-headers.mjs
• From desktop/: npm run verify:build-scripts, npm run service-contracts:check, npm run typecheck, npm run lint, npm run dead-code:check, and npm run test:unit -- --cache=false.
• From desktop/: npm run build and npm run build:modular-binaries.
• From services/nvpair-engine-manager/: go test ./... -count=1 -skip '^TestRemoveTreePreserving_ReportsUndeletableEntriesAndRemovesOthers$'.
• From services/nvpair-ui-broker/ and services/nvpair-tui/: go test ./... -count=1.
• From services/shared/: go test ./enginesettings -count=1.
• python scripts/release-intent/validate_pr.py --description-file .build/modelscope-pr/pr-description.md, with the PR base/head supplied to enforce bot-owned paths.

Coverage includes HTTP fixtures, real worker settings rebind/reload, persisted source selection, actual child environment handling, broker journal recovery, catalogue cache separation, and desktop bridge payloads. Initial implementation validation also checked live public ModelScope metadata and file HEAD requests.

The named engine-manager permission test is excluded on Windows; it failed identically on the untouched upstream baseline during initial validation. The remaining full engine-manager suite has one failure, TestStopAll_StopsDetachedCommandDaemonBeforeReadiness (missing stop-marker file). The identical failure was reproduced by the full suite on untouched develop at c0d2b62; the test passes in isolation on this branch and in ten isolated upstream runs. This existing Windows suite-order/timing issue is not fixed in this PR.

Unix-only, Windows privilege-dependent, and opt-in live-engine checks remain untested where skipped. A complete live model-weight download and automated dropdown interaction have not been exercised.

Manual review: choose each source, Apply, reopen Settings, and confirm the saved value and model browser. Check the running-engine restart confirmation and that applying to a stopped engine leaves it stopped.

Compatibility and limits

Only public, ungated ModelScope repositories are supported. Hugging Face authorization and cookies are never forwarded to ModelScope or its download hosts. Repositories reaching ModelScope's 3,000-entry recursive listing cap are rejected rather than presenting incomplete models. Repository availability can differ between sources.

The engine-manager and broker bumps cover the additive setting/API behavior; the TUI patch covers the shared settings payload it consumes. Version and changelog files remain owned by release automation.

Checklist

• Read the contribution guidelines and applicable architecture rules.
• Every commit has a matching DCO sign-off.
• Tests cover the change and documentation is updated.
• Reviewed changed filenames, diff, and commit messages for credentials, private data, internal URLs, and generated artifacts.
• Declared service bumps in the release-intent block.