PoR: Remove unused hf_pretrained compatibility APIs

[yaoyu-33]

Summary

Clean up unused and misleading compatibility APIs under
src/megatron/bridge/models/hf_pretrained.

A repository-wide usage audit at commit
030500e291cff2f4cb739453c93c8b9b0427890f found two dead symbols, a VLM
wrapper that is never instantiated by production code, and several custom
StateDict conveniences used only by tests and documentation.

Scope

Remove dead symbols

• Remove the unused SAFE_REPOS constant from hf_pretrained/utils.py.
• Remove stale documentation that still describes organization-based implicit
  trust. trust_remote_code must remain an explicit user decision.
• Remove the unreachable private
  SafeTensorsStateSource._get_key_to_filename_map() pass-through. The live
  property already calls _cached_get_key_to_filename_map() directly.

Remove PreTrainedVLM

• Remove hf_pretrained/vlm.py and the root package export.
• Replace the 15 VLM bridge imports and provider_bridge annotations with the
  actual wrapper type passed by AutoBridge, currently
  PreTrainedCausalLM, or a smaller existing structural type if that better
  reflects the consumed contract.
• Update mocks, unit tests, model-support skills, and documentation that refer
  to PreTrainedVLM.
• Add focused coverage proving the wrapper type and required attributes passed
  through AutoBridge.from_hf_pretrained(...).to_megatron_provider() for a VLM
  architecture.
• Preserve the transformers_compat import side effect currently reached
  through the remaining wrapper/import path.

Simplify StateDict

• Remove StateDict.regex() and StateDict.glob().
• Remove the explicit StateDict.items() override. Standard
  collections.abc.Mapping.items() behavior should remain available through
  inheritance.
• Update tests and documentation to use StateDict.__getitem__ pattern access,
  iteration, or standard Mapping methods as appropriate.
• Do not remove production-used exact lookup, has_glob, keys, get,
  __iter__, __len__, state sources, or save/load paths.

Documentation correction

• Replace the package README's nonexistent from_hf_pretrained() examples
  with the implemented from_pretrained() constructor where those examples
  remain relevant after the cleanup.

Validation

• No production, test, documentation, example, or skill references to
  PreTrainedVLM, SAFE_REPOS, StateDict.regex, or StateDict.glob
  remain.
• The custom StateDict.items implementation is gone and inherited
  Mapping.items() behavior is covered.
• AutoBridge VLM conversion/provider construction retains focused type-flow
  coverage.
• Security tests continue to require explicit trust_remote_code opt-in.
• Focused hf_pretrained, state, AutoBridge, and affected VLM bridge tests
  pass.
• uv run pre-commit run --all-files passes.

Implementation guidance

Keep this as a behavior-preserving cleanup for active conversion paths. The
removed public compatibility surfaces are intentionally accepted as cleanup
because there are no in-repository runtime consumers. Review the final diff for
external-facing release-note implications before merge.

[yaoyu-33]

Implementation is up in #4719: #4719

Progress:

• Commit: 2bcb8e6f156ef4607b11af1b034e85eab283b997
• Focused validation: 513 unit tests passed; direct import/stale-reference checks passed; all-files pre-commit passed.
• Two independent review rounds completed; the first config-only VLM/Kimi finding was fixed, and the second found no material issues.
• /ok to test was posted for the exact SHA, and CICD NeMo has started: https://github.com/NVIDIA-NeMo/Megatron-Bridge/actions/runs/28903365908

[yaoyu-33]

PR #4719 feedback update is pushed in 50d23009134d44d7baa20a1aa04294e5e39881e1.

• Unified LLM/VLM provider inputs on PreTrainedCausalLM; removed ProviderBridgeInput.
• Kept config-only provider construction weightless via an internal config-backed causal wrapper with unavailable weight state.
• Added real Kimi and MiMo config-only AutoBridge regressions.
• Latest focused validation: 485 tests passed; stale-reference/import checks and all-files pre-commit passed.
• Two post-feedback independent reviews completed; the state-loading finding from round one was fixed, and round two found no material issues.
• Both review threads are answered and resolved; /ok to test was posted for the exact SHA.