sync: public source for 0.2.5

[prabod]

Source sync for the 0.2.5 release, generated by the internal public-sync
workflow's allow-list (tools/sync_public.py) from internal main.

10 files changed, 0 new.

• 9 version mirrors, 0.2.4 → 0.2.5: include/baseRT/baseRT.h, the Swift
  header, both Rust binding manifests, base-convert/Cargo.toml + Cargo.lock,
  bindings/node/package.json, bindings/python/setup.py,
  bindings/python/baseRT/__init__.py.
• 1 functional change: base-convert/crates/base-convert/src/hub.rs — the
  convert-on-pull fix. The resumable range path (every file ≥ 32 MB, i.e. every
  safetensors shard) parked its result in blobs/ and wrote no
  snapshots/<rev>/ pointer, so conversion failed with no .safetensors shards
  on a pull that had downloaded every byte. Now linked into the snapshot, with
  the link target absolutised (a relative models root would otherwise dangle,
  since a symlink target resolves relative to the link's directory) and the
  repo-supplied filename routed through cache::id_to_relpath so a traversing
  entry cannot place a link outside the snapshot.

The tuned quant profiles under base-convert/profiles/ are held back by the
allow-list, as usual.

Overlap with #56

This carries the same fix as #56 (from @matts-path, for #54), which was
developed independently. The version here adds the absolutise and
path-traversal hardening plus two regression tests. The maintainers should
decide how to reconcile the two — this PR does not close #56.

Verification

The allow-list output was applied to a clean clone and built before this branch
was pushed (the sync workflow gates on a release build). Locally the same tree
builds and cargo test passes with 0 failing suites, including the two new
link_into_snapshot tests.