Python bindings for XetSession.new_range_upload()

[lhoestq]

Required for huggingface/huggingface_hub#4752
Follows #717

This PR is mostly LLM generated (I'm sorry I'm still too slow at writing rust :x). I tried to make sure it follows the similar coding pattern as for file uploads, and I made sure it has good test coverage. I double checked it myself, wrote some tests myself, and used it a lot to build the python PR in huggingface_hub and it works great. But some aspects require a bit more reviews like progress and abort / cancel handling.

The CI needs a HF_TOKEN secret for some of the e2e tests to work with the Hub (using bucket https://huggingface.co/buckets/hf-internal-testing/test-xet-core), let me know who i should ping to take care of this

Or if you are ok with only keeping the e2e tests with local CAS and removing the e2e ones with the Hub

---

Note

Medium Risk
New CAS upload/composition path with auth and cancel/progress behavior; mistakes could corrupt composed files or mishandle tokens, though patterns mirror existing upload commits and tests cover main edit shapes.

Overview
Adds dirty/range upload support end-to-end so clients can patch an existing CAS file by uploading only changed byte ranges instead of re-uploading the whole object.

Rust (xet_pkg) introduces XetSession::new_range_upload() with XetRangeUploadCommit / XetRangeUploadEdit (edit, insert, delete, append, commit/abort, progress hooks). Commit sorts pending edits and calls upload_ranges.

xet_data::upload_ranges now accepts an optional shared FileUploadSession so range uploads can report progress through the same session the commit holds.

Python (hf_xet) wires session.new_range_upload(original_hash, original_size, …) to XetRangeUploadCommit / XetRangeUploadEdit, including context-manager auto-commit/abort, optional progress callbacks, and GIL-friendly blocking commit. New pytest coverage exercises edit/insert/delete/append and multi-edit (including unsorted edit order) against a local CAS.

Also ignores **/__pycache__/ and extends lockfile/dev-deps for Hub-backed Rust e2e tests (HF_TOKEN).

^{Reviewed by Cursor Bugbot for commit 653f33e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit fe15ef0. Configure here.}

[cursor]

Orphaned range-upload test file

Low Severity

range_upload_commit_tests.rs is never declared as a module, so it is not compiled or run. The file also would not build or pass if included: upload_file is async but invoked without await, commit_blocking is called twice, and the delete assertion expects size 6 instead of 8.

 

^{Reviewed by Cursor Bugbot for commit fe15ef0. Configure here.}