[ckpt] feat: support HF INT4 compressed-tensors dequantization

[kaimo455]

Summary

• add on-the-fly compressed-tensors INT4 dequantization for HuggingFace checkpoint loading
• select only packed INT4 companion tensors needed by the current layer/expert slice
• wire the new flags through checkpoint conversion args, Kimi K2.5 conversion script, and dist-checkpoint config
• pass GITLEAKS_LICENSE into the existing gitleaks action so organization secret scanning can use the licensed action

Adapted from internal iCode review 120841416 patchset 11. The GitHub master branch already had the nested expert-id flattening helper, and docker/Dockerfile.internal no longer exists there, so those parts are naturally absent from this public diff. The CI workflow change is GitHub-only and requires the repository or organization secret GITLEAKS_LICENSE to be configured.

Verification

• git diff --check origin/master..HEAD
• python -m compileall -q tools/convert_checkpoint/arguments.py tools/convert_checkpoint/huggingface/compressed_tensors_dequant.py tools/convert_checkpoint/huggingface/huggingface_checkpoint.py tools/convert_checkpoint/module_convertor/model.py tools/dist_checkpoint/checkpoint/hf_checkpoint_converter.py tools/dist_checkpoint/config/parallel_config.py