Support W&B 0.28 and vLLM 0.24 DSV4 LoRA

[bradhilton]

Summary

• upgrade ART's backend W&B pin from 0.25.0 to 0.28.0
• declare the lora_manager attribute required by vLLM 0.24's runtime-checkable LoRA protocol for DeepSeek V4
• add a focused regression for the DSV4 protocol contract

Why

Caladan's live DeepSeek-V4-Flash qualification exposed two integration gaps. ART's backend W&B pin conflicted with Caladan's validated W&B 0.28 dependency, and vLLM 0.24 rejected the patched DSV4 model after weight loading because the structural LoRA protocol now requires lora_manager.

The Click 8.2 override is required because W&B 0.28 requires Click 8.2 or newer while ART's current SkyPilot development dependency still declares an older upper bound. ART's existing CLI smoke test remains functional; this follows the same override already used by Caladan.

Validation

• 94 selected W&B/backend/trainer/DSV4 tests passed
• 2 focused DSV4 runtime patch tests passed
• uv lock --check passed
• focused Ruff and format checks passed
• Caladan live qualification passed base and rank-8 LoRA inference on 2xB200
• Caladan full suite: 426 passed, 3 skipped, 19 subtests; full prek passed

Full ART type checking still reports existing CPU-environment Megatron/Torch and missing optional einops diagnostics; none originate in this diff.