chore: repo hygiene, CI consistency and documentation fixes

[Perseus14]

Summary

Mechanical repo-hygiene pass: broken README commands, stale/incorrect docs, dead files, and CI/tooling
inconsistencies. No functional code changes — ruff and pyink output is unchanged, and
make deps_table_check_updated now passes.

Single commit on purpose (AddPullReady requires it); 30 files, +438/−422.

README — commands that did not work as written

• per_device_batch_size=.0.25 → 0.25 (fails float()); gs:/ → gs:// (×2); shell comment placed after a \
  continuation and a dangling trailing \ in the Wan LoRA command.
• Unterminated quote in pip install "transformer_engine[jax] — closed and pinned to ==2.1.0 (as in setup.sh).
• pip install -r requirements.txt → the real generated path (there is no root requirements.txt); clone URL org
  google → AI-Hypercomputer.
• cudnn_te_flash → cudnn_flash_te (registered kernel name); non-existent ici_fsdp_batch_parallelism →
  ici_data_parallelism; duplicated class_prompt= removed from the Dreambooth command.
• Flux v6e block-size links fixed (#L79-L89 / #L85-L95); v5p-128 → v5p-256 for the 128-chip example;
  remat-policy mention, synthetic-data instructions, test-directory references, TOC (Flux.2-Klein,
  Ulysses/Ring/Caching/Tile-size), What's-new ordering, misc typos.

docs/

• docs/README.md: drop dangling train_README.md link; index the dgx_spark/profiling/metrics/attention docs.
• profiling.md: replace a Google-internal pantheon.corp.google.com URL with console.cloud.google.com.
• first_run.md, run_maxdiffusion_via_xpk.md, data_README.md, dgx_spark.md: typos, wrong clone URL, stale
  "Tensorflow >= 2.12" requirement, pipeline count (5, add synthetic row).
• src/maxdiffusion/configs/README.md: document all 22 configs (15 were missing), grouped by model family.

Repo hygiene

• Remove stray 1.3 MB test_lightning.png from the repo root (tests use the tests/images/ copy), unused
  _typos.toml, and .github/actions/setup-miniconda (uses deprecated actions/cache@v2).
• Trim Makefile to targets that exist (diffusers-inherited targets referenced missing dirs/scripts).
• Regenerate dependency_versions_table.py so it matches utils/update_dependency_table.py; fix its docstring.
• .gitignore: narrow .gemini/ to .gemini/* + !.gemini/commands/ so the tracked review-command files are no
  longer shadowed.

CI / tooling

• zizmor (org security scan) fixes — the scan runs on every workflow file a PR touches and now enforces
  hash-pinning as a blanket policy, so the 7 touched workflow files had to be brought into compliance. These were
  pre-existing findings, not regressions; the fixes mirror MaxText's (same SHAs and # vX.Y.Z format):
  • unpinned-uses (×13, High/mandatory): every third-party uses: pinned to a commit SHA. Versions unchanged
    except run-gemini-cli@main → v0.1.22 (a moving branch cannot be pinned by tag).
  • excessive-permissions (×3, Medium): top-level permissions: contents: read added to CPUTests.yml,
    UnitTests.yml, UploadDockerImages.yml (none of those jobs use the token for anything but checkout;
    image pushes use the runner's gcloud identity).
  • secrets-inherit (×2, Medium): gemini-dispatch.yml passes APP_PRIVATE_KEY/GEMINI_API_KEY/GOOGLE_API_KEY
    explicitly; gemini-review.yml/gemini-invoke.yml declare them under workflow_call.secrets (required: false).
• CPUTests.yml: checkout@v3/setup-python@v4 → v5 (GitHub-hosted runner); fix pend_to_end typo.
• UnitTests.yml: drop unused isort install and a dead commented block; UploadDockerImages.yml: fix header.
• pre-commit: stop excluding .github/ from whitespace/EOF hooks; normalize existing files.
• code_style.sh: warn when local pyink ≠ 23.10.0 (the CI/pre-commit version).
• pyproject.toml: JAX-accurate description/keywords; quality/dev extras use pyink/pylint/ruff instead of unused
  black/isort/hf-doc-builder; ruff line-length aligned to 125.

Scripts / Docker

• docker_build_dependency_image.sh: header was copy-pasted from docker_upload_runner.sh.
• maxdiffusion_gpu_dependencies.Dockerfile: dockerfile:1 syntax, typo, remove RUN ls . and duplicate WORKDIR.
• setup.sh: remove dead commented block; fix "libtpu" wording in the GPU log line.
• unit_test_and_lint.sh: remove dead commented pylint line.
• Review follow-ups: make deps_table_check_updated now removes its temporary md5sum.saved on failure too;
  setup.sh uses python3 -m pip install uv (consistent with the rest of the script).

Verification

• ruff check . clean; pyink --check clean (349 files); all workflow YAML and pyproject.toml parse;
  bash -n on every touched script; make deps_table_check_updated passes.
• README code fences balanced; zero broken heading anchors or relative links across all .md files
  (scripted check); no trailing whitespace.
• zizmor 1.25.2 (the CI version) run locally with the CI job's own zizmor-config.yaml and flags
  (--min-confidence medium, online + offline) over the 7 touched workflows: 0 findings (was 13 High + 5 Medium).

Deliberately not changed

• CPUTests.yml job name "CPU tests" (may be a required status check).
• UnitTests.yml action versions (self-hosted TPU runners; v5 actions need Node 24) — only SHA-pinned at the
  versions it already used.
• AddPullReady.yml / pypi_release.yml are not touched by this PR, so the scan does not cover them, but they have
  the same unpinned-uses findings (and AddPullReady.yml a dangerous-triggers one) and will hit the same wall
  when next edited.
• Pinning pyink in requirements (pyink 23.10 needs black==23.10, which conflicts with the generated
  black>=25.12 and would break setup.sh).

Follow-up

A second, stacked PR migrates the deployment docs from the deprecated XPK to Cluster Toolkit (gcluster).

[github-actions]

e2e testgrid: https://8bcf50593faf4ea38060e236169827e5-dot-us-central1.composer.googleusercontent.com/dags/maxdiffusion_tpu_e2e/grid

[gemini-code-assist]

Code Review

This pull request streamlines the repository's build, formatting, and dependency management systems. It simplifies the Makefile, updates python dependencies to use pinned versions of pyink and pylint, and significantly expands documentation for various model families like Wan 2.1/2.2, Flux, and LTX. Feedback on the changes suggests cleaning up temporary files in the Makefile upon target failure and using 'python3 -m pip' instead of 'pip' in setup.sh to ensure broader compatibility across different environments.