feat(moe): Ling 3.0 (bailingmoe3) support

[Helldez]

What

Ling 3.0 support (bailingmoe3), e.g. Ling-3.0-flash: 127B total, ~5B active, 512 routed experts. Upstream merged BailingMoE3 today (ggml-org/llama.cpp#26608); this PR bumps the submodule to that base and adds the one registry row the streamer needs.

How

• Submodule bump to fork branch bmoe/expert-ready-hook-ling3: the same single expert-ready-hook commit, cherry-picked clean onto upstream 3733366. The previous fork branch stays untouched so the old pin remains reachable. The jump crosses 496 upstream commits.
• Recipe row. bailingmoe3 combines patterns the registry already carries: split expert suffixes, biased top-k (the lfm2moe pattern), a resident shared expert, leading dense blocks, and a NextN/MTP block llama.cpp does not load by default.
• Three adaptations the new base forces, all on our side of the seam:
  • llama_model_params.use_mmap became the load_mode enum. The streamer's required layout is now pinned with LLAMA_LOAD_MODE_MMAP.
  • The nextn/MTP tensors are now skipped at load unless load_mtp is set, and it defaults to off, so --mtp would have built its second context over a block whose tensors were never loaded. It fails badly rather than loudly: n_layer_nextn comes from the gguf metadata and stays non-zero either way, so the "no trained MTP head" guard would have passed and the trouble surfaced further in. The block is now requested exactly when speculation asks for it.
  • gpt-oss/harmony now declares its thinking tags, so the think-control probe decides by mechanism instead: a prefill that moves past the closed span into further structure of the format itself is binding, while one that just ends at the closing tag is only a suggestion (LFM2.5 stays reported as uncontrollable).

Evidence

Byte-identity gates pass on the new base (qwen3moe, gemma4, 4-shard split): streamed == resident.

PC smoke on Qwen3.6-35B-A3B, every cell of the recipe that still applies, against the recorded baseline:

cell	tok/s	read/token	hit	signal
plain	2.14	270.5 MiB	39.6%	coherent text (baseline 2.11 / 272 / 36%)
--ngram --draft 3	2.14	270.5 MiB	39.6%	drafted on 0 of 24 steps, identical to plain, which is the designed property
--route-ahead 2	2.68	264.3 MiB	69.0%	2984/2984 speculated experts useful, stall 0.30 down to 0.04
--mtp --draft 3	2.25 (2.09 effective)	313.4 MiB	23.9%	17/19 drafts accepted, 3.43 tokens per verify

(--odirect-zero-copy is not in main, it lives on the PR #143 branch, so that cell does not apply here.)

think_control covers the new probe logic: harmony as prefill, LFM2.5 as none, non-reasoning LFM variants as template.

Not covered

No device run yet, and no load of gpt-oss, lfm2moe or deepseek4 on the new base. Given the size of the upstream jump, a device validation is owed before this is released.

App version 0.20.0 (versionCode 35). A catalog entry for Ling follows once a reputable quantized upload exists; the URL field and file picker already take any bailingmoe3 gguf.