fix(format-adapters): derive component configs from weights (#261 #267) + path-traversal containment

- weight_derived_config.py (new): derive transformer/VAE/TE/vision-encoder dims from
  safetensors weights via data-driven descriptor tables — fixes #261 (official single-file
  loaders) + #267 (Klein 9B TE hidden_size 2560->4096 derived from weights, not bundled config)
- hf_layout.py: _add_component realpath-containment (path-traversal fix) + add_* route through
  _with_weight_derived_*; hf_native.py vision_encoder via derive layer; safetensors_io.py 128MB header cap
- transformer_dims.py removed (superseded by weight_derived_config.py)
- bin/vae_configs/*.json: VAE class presets
fixer 5-dim self-CR all-GO + orchestrator 6.5 5-dim all-GO + renders visually clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>