[inureyes]

Implements #2468: the four token-classification leftovers in one PR.

Item 1: GLiNER2.5 CLI options

mlxcel extract gains --max-len <N> and --word-splitter <whitespace|char>, wired through SpanExtractorLoadOptions and load_span_extractor_with to the loaded Gliner2_5Model. A max_len outside 1..=MAX_SUPPORTED_MAX_LEN produces the existing config error text (GLiNER2.5 max_len must be an integer in 1..=32768, got ...) before any model loads, and an unknown splitter is refused with --word-splitter must be whitespace or char, got '<value>'. Absent flags keep the checkpoint's own values. The char splitter scores every non-space character separately for scripts without word spacing such as CJK.

Tests: extract_gliner_flags_parse and extract_gliner_flags_reject_bad_values go through the real Cli parser (both were written first and failed to compile before the flags existed), and two checkpoint-backed gates run against fastino/gliner2.5-small-v1: --word-splitter char on the fixture's CJK case matching the mlx-vlm char case, and --max-len reaching the loaded model including the out-of-range text. Flags are visible in mlxcel extract --help.

Item 2: Viterbi f64 accumulation

The constrained BIOES lattice sums in f64 as upstream's f64 bias adds do, keeping the public decode(&[Vec<f32>]) -> Vec<usize> signature and tie resolution. f64_accumulation_keeps_an_increment_f32_loses decodes a lattice where at V = 2^24 the f32 ULP is 2 and V + 1 rounds back to V, tying the closing E-x; f64 keeps the increment and closes the entity. All existing Viterbi tests pass unchanged.

Item 3: band mask once per chunk

The Privacy Filter band masks are built once per query chunk per forward (band_windows) and shared by every layer, instead of per chunk per layer. Spans are unchanged on the existing fixtures, and band_masks_are_built_once_per_chunk_per_forward counts BAND_MASKS_BUILT: 40 tokens in 7-query chunks builds 6 masks, not 12.

Item 4: checkpoint shape validation

PrivacyFilterModel::from_weights validates every dense tensor against the config-derived shapes before the model graph is built and returns an error naming the tensor with its expected and actual shape, instead of aborting inside MLX. malformed_shapes_error_with_the_tensor_named covers a missing tensor, a wrong rank and a wrong dimension, and proves a quantized plane (a .scales sibling) is skipped.

Validation

The filtered cargo test --profile test-fast runs for token_classification, extract and openai_privacy_filter with --test-threads=1, extract --help, cargo fmt --all -- --check and cargo clippy --profile test-fast -- -D warnings pass locally with --features cuda on GB10 (test binary under gpu-lock, MLX_CUDA_ARCHITECTURES=121, MLX_ENABLE_TF32=0).

Closes #2468