other: switch vllm source to rebellions internal pypi

[rebel-minhopark]

🚀 Summary of Changes

Switches the vllm dependency from the public vllm-cpu index to the internal rebellions PyPI (https://pypi.rebellions.in/simple), and bumps the pinned version to 0.18.1.dev2+g4a5535958.d20260417.cpu.

• pyproject.toml
  • vllm==0.18.0+cpu → vllm==0.18.1.dev2+g4a5535958.d20260417.cpu
  • Added a new [[tool.uv.index]] entry named rebellions
  • [tool.uv.sources] updated so that vllm = { index = "rebellions" }

---

📌 Related Issues / Tickets

• Resolves #
• Related to #

---

✅ Type of Change

• 🚀 Release (release)
• ✨ Feature (feature)
• 🧠 Model support (model)
• 🧬 Core engine changes (core)
• 🛠 Bug fix (fix)
• ⚙️ Performance improvement (perf)
• 🔁 Refactor or code cleanup (refactor)
• 📄 Documentation (docs)
• ❓ Other (other): dependency / package index change

---

🧪 How to Test

1. Run uv sync
2. Verify output: uv pip show vllm reports 0.18.1.dev2+g4a5535958.d20260417.cpu, sourced from pypi.rebellions.in
3. Edge case tested: run an existing 0.18.0-ax-k1-fp8 inference path and confirm no regression

---

📸 Screenshots / Logs (if applicable)

N/A

---

📋 Checklist

• PR title follows Conventional Commits format
• This PR is linked to an existing issue
• The test method is described, and the expected result is clearly stated
• Relevant documentation has been updated (if applicable)

---

💬 Notes

• Base branch: 0.18.0-ax-k1-fp8
• uv.lock is not included in this commit. If needed, it can be regenerated and pushed as a separate commit.
• The rebellions index may require internal network / VPN access. Please verify that CI environments can reach it.

[rebel-minhopark]

Note for reviewers — CI failure context

The CI failure on this PR can't be fixed within the PR itself, so flagging the context here.

Why this PR exists:
This change is needed for the Rebel MoE PoC. We need to use vllm==0.18.1.dev2+g4a5535958.d20260417.cpu, which is published on our internal PyPI and contains the patched A.X K1 FP8 model code.

Problem with the current dependency:
If pyproject.toml is not updated, users who want to run A.X K1 FP8 have to:

1. Install vllm==0.18.0+cpu first (the current vllm-rbln dependency), then
2. Manually overwrite it with vllm==0.18.1.dev2+g4a5535958.d20260417.cpu.

This double-install is inconvenient and error-prone.

Why bumping is safe:
I've verified that the new vLLM version works correctly with gpt-oss, MiniMax, and A.X K1 PR. So switching the pinned version should resolve the dependency UX issue without breaking the other supported models.

The CI failure appears to be related to the new index/version not being reachable from the CI environment (the rebellions index may require internal network access). Reviewers, please let me know how you'd like to handle the CI side — happy to coordinate on access or split the change if needed.

[rebel-jinhwan]

@rebel-minhopark https://rebellions-ai.slack.com/archives/C07DVK01Y8L/p1778653221669799 여기 논의된대로 의존성을 내부 pypi에 걸어버리는게 아직 검토가 완료안된 사항인것으로 알고있습니다..