fix(auto): retain nested download paths in downstream handoffs

[DivyamTalwar]

Summary

Fixes #19.

fetch writes dest/fname including remote directories, but auto reconstructs several local paths from basename(fname). A completed nested download then produces missing probe/runtime inputs or an inaccurate local-file lookup. Preserve the exact downloaded source path in standard, custom, split-first-part and existing-file handoffs; keep the newly built depth-aware output naming unchanged.

Testing

Base: 252e5193902d466726da9af75047dfffff2ae662. Debian 12 Linux aarch64 in a nonroot disposable container, Python 3.11. The full existing smoke exits 0 with eight explicitly reported pre-existing optional research/hardware skips. It also prints baseline diagnostic skips where simulator/research dependencies are absent; no skipped check is counted as a pass. No Windows run or GPU/real-model benchmark is claimed.

The same final test files fail against unchanged production; the corrected branch gives:

Focused: 7 passed in 0.07s
Full applicable suite: 8 SKIPPED (a skip is not a pass):
all green

python tests/smoke.py
ruff check quantprobe
ruff format --check quantprobe
# Bandit medium-severity checks on changed package modules
git diff --check

All applicable commands above exited 0 locally. The snapshot is a complete upstream checkout plus this branch's exact changed-file bytes; no test is a copied production-function reimplementation. External I/O is mocked where stated. Dependencies and lockfiles are unchanged.

Security And Data Access

No credential, production-data, authentication, read-only guardrail or privileged workflow changes are included. Tests use synthetic inputs and disposable paths. No new benchmark, fitted law, or hardware capability is claimed.

Notes

Tests drive the real CLI and orchestration with synthetic downloads that create tiny sentinel files, mocked GGUF parsing and mocked inference stages. This repairs path bookkeeping, not download transport or parent creation. Nested-parent creation remains the separate fetch contribution. No new containment or permission guarantee, live download or inference measurement.

AI-assisted implementation, isolated same-provider source review, and controller regression checks are disclosed. They are not maintainer approval, cross-vendor certification, or hosted CI. One focused, signed-off commit; no generated logs, personal config, model weights or worktree state is included.

Draft pending upstream CI and maintainer review. Companion changes touching the same module/test hook may require rebasing as they land; no combined branch is being submitted.