refactor(deps): rename ragflow_deps directory to deps (#21345)

## Summary

Rename the repository dependency-resource directory `ragflow_deps/` to
`deps/`, and update every hardcoded reference to that directory name so
the rename does not break resource loading at build/runtime.

This is not a purely cosmetic rename: the Go runtime hardcodes the
directory name as a resource search path (e.g.
`internal/common/model_assets.go` trimming the `deps/` prefix, and the
tokenizers joining `deps/` into candidate paths), and the Dockerfiles
copy assets into `/ragflow/deps`. Those literals must move together with
the directory, otherwise assets fail to resolve.

## Two intentional exceptions (kept unchanged)

The rename deliberately keeps two names that only *coincidentally*
contained the old string:

- The published image tag `infiniflow/ragflow_deps:latest` (used by
`Dockerfile`, `Dockerfile_base`, docs, and CI `image inspect` checks).
- The CI install path `/opt/ragflow_deps` inside the CI runner image
(`build.sh` `SYSTEM_DEPS_TOKENIZER`).

## Changes

- `git mv ragflow_deps deps`.
- `build.sh`: `CL100K_TABLE_RELPATH`, native asset zip path, and related
references updated to `deps/`.
- `tools/scripts/download_dev_deps.py`: `RAGFLOW_DEPS_DIR` points at
`deps/`.
- Go runtime resource search paths (`internal/common`,
`internal/tokenizer`) updated to the `deps/` layout.
- `Dockerfile` / `Dockerfile_base`: container asset path changed to
`/ragflow/deps`; kept tag `infiniflow/ragflow_deps:latest` unchanged.
- Docs / `AGENTS.md` / CI workflow paths updated to the new directory
name.

## Test plan

- Go unit tests in `internal/common` and `internal/tokenizer` updated to
the new `deps/` layout and pass via `bash build.sh --test`.
- Python download scripts import and build URLs correctly (`py_compile`
clean).
- Added `tools/scripts/test_dep_rename_invariants.py` as a regression
guard asserting the two intentional exceptions (`/opt/ragflow_deps` and
`infiniflow/ragflow_deps`) stay intact, so a future blanket rename
cannot silently regress them.

---

## Follow-up fix (commit 2f6857095d)

The original rename used a blanket `sed s/ragflow_deps/deps/g` and only
selectively reverted `build.sh`. That left two intentionally-kept names
rewritten, which this follow-up restores:

- CI install path `/opt/ragflow_deps` — `sep-tests.yml` had been changed
to read `/opt/deps`, breaking the offline cl100k table fallback (the
cached-image path pointed at a directory that never receives the file).
Restored to `/opt/ragflow_deps`.
- Published image tag `infiniflow/ragflow_deps` — left as bare
`infiniflow/deps` in `sep-tests.yml` comments/echo, `.dockerignore`, and
`Dockerfile` / `Dockerfile_base` error messages. Restored to
`infiniflow/ragflow_deps`.

The regression guard `tools/scripts/test_dep_rename_invariants.py` was
added to prevent recurrence.

.github/workflows/sep-tests.yml

@@ -300,7 +300,7 @@ jobs:
           set -euo pipefail
 
           # Provide the cl100k BPE table for the offline tokenizer loader.
-          # The loader reads <repo>/ragflow_deps/cl100k_base.tiktoken (or
+          # The loader reads <repo>/deps/cl100k_base.tiktoken (or
           # TIKTOKEN_CACHE_DIR). Try to fetch it directly from the upstream
           # openai blob first (small ~1.6MB, reachable from the CI runner — the
           # pre-PR code downloaded it on the fly, so the network path is known
@@ -311,36 +311,36 @@ jobs:
           # neither source works, the loader still fails loudly (no silent
           # 0-token degradation).
           # tiktoken is already installed in runner
-          mkdir -p ragflow_deps
-          cp /opt/ragflow_deps/cl100k_base.tiktoken ragflow_deps/cl100k_base.tiktoken || true
-          if [ ! -f ragflow_deps/cl100k_base.tiktoken ]; then
-            mkdir -p ragflow_deps
+          mkdir -p deps
+          cp /opt/ragflow_deps/cl100k_base.tiktoken deps/cl100k_base.tiktoken || true
+          if [ ! -f deps/cl100k_base.tiktoken ]; then
+            mkdir -p deps
             if command -v curl >/dev/null 2>&1; then
-              if curl -fsSL -o ragflow_deps/cl100k_base.tiktoken \
+              if curl -fsSL -o deps/cl100k_base.tiktoken \
                 https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken; then
                 echo "tiktoken: cl100k table fetched via curl from openai blob"
               else
                 echo "tiktoken: curl fetch failed (network/GFW); will try cached image"
               fi
             fi
-            if [ ! -f ragflow_deps/cl100k_base.tiktoken ] && docker image inspect infiniflow/ragflow_deps:latest >/dev/null 2>&1; then
+            if [ ! -f deps/cl100k_base.tiktoken ] && docker image inspect infiniflow/ragflow_deps:latest >/dev/null 2>&1; then
               CID=$(docker create infiniflow/ragflow_deps:latest true) || true
               if [ -n "${CID:-}" ]; then
-                if docker cp "$CID":/cl100k_base.tiktoken ragflow_deps/cl100k_base.tiktoken 2>/dev/null; then
+                if docker cp "$CID":/cl100k_base.tiktoken deps/cl100k_base.tiktoken 2>/dev/null; then
                   echo "tiktoken: cl100k table copied from cached infiniflow/ragflow_deps image"
                 fi
                 docker rm -f "$CID" >/dev/null 2>&1 || true
               fi
             fi
           fi
-          if [ -f ragflow_deps/cl100k_base.tiktoken ]; then
-            echo "tiktoken: cl100k table provisioned ($(wc -c < ragflow_deps/cl100k_base.tiktoken) bytes)"
+          if [ -f deps/cl100k_base.tiktoken ]; then
+            echo "tiktoken: cl100k table provisioned ($(wc -c < deps/cl100k_base.tiktoken) bytes)"
           else
             echo "tiktoken: cl100k table NOT provisioned — offline loader will fail loudly"
           fi
 
           # Provide the tokenizer assets the four non-cl100k counters load
-          # (ragflow_deps/huggingface.co/<repo>/<file>). Their only no-network source
+          # (deps/huggingface.co/<repo>/<file>). Their only no-network source
           # is the infiniflow/ragflow_deps image — the runtime images read them from
           # exactly the same path — so this is the same "if the image is already
           # cached" fallback the table above uses (again, no `docker pull`). Without
@@ -356,7 +356,7 @@ jobs:
             CID=$(docker create infiniflow/ragflow_deps:latest true) || true
             if [ -n "${CID:-}" ]; then
               for asset in "${TOKENIZER_ASSET_PATHS[@]}"; do
-                target="ragflow_deps/huggingface.co/$asset"
+                target="deps/huggingface.co/$asset"
                 if [ -f "$target" ]; then
                   continue
                 fi
@@ -846,7 +846,7 @@ jobs:
           set -euo pipefail
 
           # Provide the cl100k BPE table for the offline tokenizer loader.
-          # The loader reads <repo>/ragflow_deps/cl100k_base.tiktoken (or
+          # The loader reads <repo>/deps/cl100k_base.tiktoken (or
           # TIKTOKEN_CACHE_DIR). Try to fetch it directly from the upstream
           # openai blob first (small ~1.6MB, reachable from the CI runner — the
           # pre-PR code downloaded it on the fly, so the network path is known
@@ -857,36 +857,36 @@ jobs:
           # neither source works, the loader still fails loudly (no silent
           # 0-token degradation).
           # tiktoken is already installed in runner
-          mkdir -p ragflow_deps
-          cp /opt/ragflow_deps/cl100k_base.tiktoken ragflow_deps/cl100k_base.tiktoken || true
-          if [ ! -f ragflow_deps/cl100k_base.tiktoken ]; then
-            mkdir -p ragflow_deps
+          mkdir -p deps
+          cp /opt/ragflow_deps/cl100k_base.tiktoken deps/cl100k_base.tiktoken || true
+          if [ ! -f deps/cl100k_base.tiktoken ]; then
+            mkdir -p deps
             if command -v curl >/dev/null 2>&1; then
-              if curl -fsSL -o ragflow_deps/cl100k_base.tiktoken \
+              if curl -fsSL -o deps/cl100k_base.tiktoken \
                 https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken; then
                 echo "tiktoken: cl100k table fetched via curl from openai blob"
               else
                 echo "tiktoken: curl fetch failed (network/GFW); will try cached image"
               fi
             fi
-            if [ ! -f ragflow_deps/cl100k_base.tiktoken ] && docker image inspect infiniflow/ragflow_deps:latest >/dev/null 2>&1; then
+            if [ ! -f deps/cl100k_base.tiktoken ] && docker image inspect infiniflow/ragflow_deps:latest >/dev/null 2>&1; then
               CID=$(docker create infiniflow/ragflow_deps:latest true) || true
               if [ -n "${CID:-}" ]; then
-                if docker cp "$CID":/cl100k_base.tiktoken ragflow_deps/cl100k_base.tiktoken 2>/dev/null; then
+                if docker cp "$CID":/cl100k_base.tiktoken deps/cl100k_base.tiktoken 2>/dev/null; then
                   echo "tiktoken: cl100k table copied from cached infiniflow/ragflow_deps image"
                 fi
                 docker rm -f "$CID" >/dev/null 2>&1 || true
               fi
             fi
           fi
-          if [ -f ragflow_deps/cl100k_base.tiktoken ]; then
-            echo "tiktoken: cl100k table provisioned ($(wc -c < ragflow_deps/cl100k_base.tiktoken) bytes)"
+          if [ -f deps/cl100k_base.tiktoken ]; then
+            echo "tiktoken: cl100k table provisioned ($(wc -c < deps/cl100k_base.tiktoken) bytes)"
           else
             echo "tiktoken: cl100k table NOT provisioned — offline loader will fail loudly"
           fi
 
           # Provide the tokenizer assets the four non-cl100k counters load
-          # (ragflow_deps/huggingface.co/<repo>/<file>). Their only no-network source
+          # (deps/huggingface.co/<repo>/<file>). Their only no-network source
           # is the infiniflow/ragflow_deps image — the runtime images read them from
           # exactly the same path — so this is the same "if the image is already
           # cached" fallback the table above uses (again, no `docker pull`). Without
@@ -902,7 +902,7 @@ jobs:
             CID=$(docker create infiniflow/ragflow_deps:latest true) || true
             if [ -n "${CID:-}" ]; then
               for asset in "${TOKENIZER_ASSET_PATHS[@]}"; do
-                target="ragflow_deps/huggingface.co/$asset"
+                target="deps/huggingface.co/$asset"
                 if [ -f "$target" ]; then
                   continue
                 fi
@@ -937,7 +937,7 @@ jobs:
             ./build.sh --test -- $PKGS
           fi
 
-      - name: Run ragflow_deps regression guards
+      - name: Run deps regression guards
         # Local, needs no API keys or model downloads; guards (a) the native
         # archive / ONNX Runtime extraction logic the in-process (Go) DeepDoc
         # backend build depends on (notably the version-bump path), and (b) the
@@ -1813,15 +1813,15 @@ jobs:
         # (e.g. a non-standard runner). Mirrors the ragflow_native_backend job.
         run: |
           set -euo pipefail
-          mkdir -p ragflow_deps
-          cp /opt/ragflow_deps/cl100k_base.tiktoken ragflow_deps/cl100k_base.tiktoken || true
-          if [ ! -f ragflow_deps/cl100k_base.tiktoken ] && command -v curl >/dev/null 2>&1; then
-            curl -fsSL -o ragflow_deps/cl100k_base.tiktoken \
+          mkdir -p deps
+          cp /opt/ragflow_deps/cl100k_base.tiktoken deps/cl100k_base.tiktoken || true
+          if [ ! -f deps/cl100k_base.tiktoken ] && command -v curl >/dev/null 2>&1; then
+            curl -fsSL -o deps/cl100k_base.tiktoken \
               https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken || \
               echo "tiktoken: curl fetch failed; offline loader will fail loudly"
           fi
-          if [ -f ragflow_deps/cl100k_base.tiktoken ]; then
-            echo "tiktoken: cl100k table provisioned ($(wc -c < ragflow_deps/cl100k_base.tiktoken) bytes)"
+          if [ -f deps/cl100k_base.tiktoken ]; then
+            echo "tiktoken: cl100k table provisioned ($(wc -c < deps/cl100k_base.tiktoken) bytes)"
           else
             echo "tiktoken: cl100k table NOT provisioned — offline loader will fail loudly"
           fi