chore(model gallery): 🤖 add 1 new models via gallery agent

[localai-org-maint-bot]

This PR was automatically created by the gallery agent workflow.

Summary:

• Search Term: GGUF
• Models Found: 15
• Models Added: 1
• Quantization: Q4_K_M
• Processing Time: 470.418061ms

Added Models:

• orcarouter/Qwen3.8-27B-Uncensored-GGUF

Bot commands

Maintainers (owner / member / collaborator) can control this PR
by leaving a comment with one of:

• /gallery-agent recreate — close this PR; the next scheduled
  run will propose this model again (useful if the entry needs
  to be regenerated with fresh metadata).
• /gallery-agent blacklist — close this PR and permanently
  prevent the gallery agent from ever reproposing this model.

Plain "Close" (without a command) is treated as a no-op: the
model may be reproposed by a future run.

Workflow Details:

• Triggered by: schedule
• Run ID: 33630073650
• Commit: 7c921aa02093b98ae2e0368e4c1b3abd25670759

[localai-org-maint-bot]

Review pass. Blocking for the same reason as #11832, plus a name collision.

Placeholder checksums from a gated repo. Both files carry the literal mask the HF API returns for gated repos:

sha256: '****************************************************************'

orcarouter/Qwen3.8-27B-Uncensored-GGUF is gated: auto and returns HTTP 401 anonymously, so the download fails for users and the checksum could not verify anyway.

Name collision. This PR and #11847 both want the gallery name qwen3.8-27b-uncensored, from two different upstream repos. Only one can land under that name. #11847 points at JonathanColetti/Qwen3.8-27B-Uncensored-GGUF, which is ungated and whose checksums verify, so that is the better candidate for the name.

Suggest closing this one in favour of #11847 unless there is a reason to prefer the orcarouter build.

[localai-org-maint-bot]

Holding this one: the sha256 fields are not digests.

Every entry in this PR carries 64 literal asterisks as its checksum:

sha256: '****************************************************************'

I checked the raw bytes to rule out display masking — the file really does contain * characters.

That is worse than omitting the field. DownloadFileWithContext skips verification only when the digest is empty; a non-empty value means it verifies, compares the computed hex against the asterisks, deletes the download and returns SHA mismatch for file .... So the entry can never install, after pulling a Q4_K_M plus its mmproj.

Two other things worth a look while this is open:

• The description is the upstream model card pasted verbatim, including GitHub > [!Note] / > [!Tip] callouts that will not render in the gallery UI, Qwen Cloud's hosted-API marketing, and a literal ... truncation marker.
• The weights point at orcarouter/Qwen3.8-27B-Uncensored-GGUF — a vendor-hosted repackage rather than the publisher's own repo. Same vendor as docs(cloud-proxy): add OrcaRouter passthrough example #11657. Worth deciding deliberately whether vendor rehosts belong in the gallery.

Real digests can be read from HuggingFace's tree API (lfs.oid is the content sha256).