fix(recipes): [cherry-pick 1.3.0] bump Hugging Face Hub helper-job pins to 1.16.4 (DYN-3335)

[MatejKosec]

Summary

Cherry-pick of #10986 to release/1.3.0 for DYN-3335 / NVBug 6401769.

• Updates the Hugging Face Hub CLI pin from 1.11.0 to 1.16.4 in 17 model-download recipes and two vLLM LoRA sync jobs, so the helper jobs install the click dependency required by hf download.
• Preserves the 18-file patch from fix(recipes): bump Hugging Face Hub helper-job pins to 1.16.4 #10986 without content changes.
• Adds the same pin replacement to recipes/qwen3-vl-32b-fp8/model-cache/model-download.yaml. DYN-3335 lists this as the seventeenth affected recipe, but fix(recipes): bump Hugging Face Hub helper-job pins to 1.16.4 #10986 omitted it; the file still has the broken pin on both main and release/1.3.0.

The remaining main copy of qwen3-vl-32b-fp8 requires a separate follow-up PR.

Original PR: #10986
Linear: https://linear.app/nvidia/issue/DYN-3335
NVBug: 6401769

Validation

• The commit-time pre-commit suite passed, including YAML validation, conflict checks, codespell, whitespace checks, and the static pytest-marker report.
• The original 18-file subset has the same stable patch ID as fix(recipes): bump Hugging Face Hub helper-job pins to 1.16.4 #10986: 4d19db1e97acea77a3cc41d61f2938725665eee3.
• Static inspection found no remaining huggingface[_-]hub==1.11.0 pins in recipes/ or the affected vLLM LoRA examples.
• All 19 changed helper-job files retain an hf download command.
• git diff --check upstream/release/1.3.0...HEAD passed.

A Kubernetes model-download job was not rerun for this release port. #10986 validated huggingface_hub==1.16.4 in a clean Python environment; release CI remains required.

Test plan

• CI passes against release/1.3.0.
• Review confirms the 18-file cherry-pick plus the one issue-required supplemental recipe change.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[dagil-nvidia]

Release backport quality gate: the original 18-file patch matches #10986, the supplemental issue-required recipe fix was reviewed, and release CI recovered to 27 passed / 37 expected skips / 0 failures at head 002a81d.