Split credential setup out of slurm-setup.md into credentials.md

Addresses three overlapping review comments on slurm-setup.md:62
from PR #1239:

- @mxinO: NGC/HF/Docker tokens aren't SLURM-specific — wanted a
  general credential setup guide referenced from multiple skills.
- CodeRabbit: `$oauthtoken` needs to be called out as a literal NGC
  login string, not a shell variable to substitute.
- Copilot: the previous snippet overwrote `~/.config/enroot/.credentials`
  unconditionally, clobbering entries for other registries.

New `skills/common/credentials.md` covers HF_TOKEN, NGC API key (Docker
+ enroot paths), and Docker Hub. The NGC/enroot block uses an
append-if-missing pattern (`grep -q ... || echo ... >>`) and spells
out that `$oauthtoken` is a literal, kept unexpanded via single quotes.

`slurm-setup.md` now keeps only the pyxis-specific signpost — one
paragraph pointing at `credentials.md` for the actual setup.

Signed-off-by: Zhiyu Cheng <zhiyuc@nvidia.com>

Author: Edwardf0t1

.claude/skills/common/credentials.md

@@ -0,0 +1,60 @@
+# Credentials Setup
+
+Tokens and registry credentials that ModelOpt workflows need across local and cluster environments. Not SLURM-specific — referenced from PTQ, deployment, evaluation, and slurm-setup skills.
+
+## HuggingFace token (`HF_TOKEN`)
+
+Required for gated models (e.g., Llama, Mistral, some Nemotron variants) and gated datasets (e.g., GPQA, HLE).
+
+Generate at <https://huggingface.co/settings/tokens>, then export:
+
+```bash
+export HF_TOKEN=hf_...
+```
+
+Persist in `~/.bashrc` or a project-local `.env` file. For remote clusters, check whether the cluster's shell config already sets it: `ssh <cluster-login> 'env | grep -c HF_TOKEN'`.
+
+## NGC API key (for `nvcr.io`)
+
+Required for pulling NGC images (`nvcr.io/nvidia/pytorch:...`, `nvcr.io/nvidia/vllm:...`) via Docker, `srun --container-image`, or enroot.
+
+Generate at <https://ngc.nvidia.com/setup/api-key>.
+
+### Docker
+
+```bash
+docker login nvcr.io -u '$oauthtoken' -p <NGC_API_KEY>
+```
+
+### Enroot (SLURM / pyxis)
+
+Add an entry to `~/.config/enroot/.credentials` on the cluster. The file may already hold credentials for other registries — **append rather than overwrite**:
+
+```bash
+mkdir -p ~/.config/enroot
+CREDS=~/.config/enroot/.credentials
+touch "$CREDS"
+grep -q '^machine nvcr.io ' "$CREDS" || \
+    echo 'machine nvcr.io login $oauthtoken password <NGC_API_KEY>' >> "$CREDS"
+chmod 600 "$CREDS"
+```
+
+> **Note**: `$oauthtoken` is a **literal string** required by NGC, not a shell variable. Do not replace it and do not let your shell expand it — the single quotes above keep it literal.
+
+Without this, `srun --container-image=nvcr.io/...` fails with `401 Unauthorized` when the compute node tries to pull.
+
+## Docker Hub login
+
+Only needed if you hit rate limits pulling public images:
+
+```bash
+docker login
+```
+
+## Summary
+
+| Credential | Used for | Set via |
+|---|---|---|
+| `HF_TOKEN` | Gated HF models / datasets | Env var (`export HF_TOKEN=...`) or `.env` |
+| NGC API key | `nvcr.io` image pulls | `docker login` or `~/.config/enroot/.credentials` |
+| Docker Hub | Rate-limited public image pulls | `docker login` |

.claude/skills/common/slurm-setup.md

@@ -53,17 +53,7 @@ srun \
 
 ### Container registry credentials (pyxis)
 
-If `srun --container-image` uses an image from a private registry (e.g., `nvcr.io/nvidia/...`), pyxis/enroot needs credentials on the cluster. Check for existing credentials and add if missing:
-
-```bash
-cat ~/.config/enroot/.credentials 2>/dev/null || echo "No credentials"
-# To add NGC credentials:
-mkdir -p ~/.config/enroot
-echo 'machine nvcr.io login $oauthtoken password <NGC_API_KEY>' > ~/.config/enroot/.credentials
-chmod 600 ~/.config/enroot/.credentials
-```
-
-Without this, `srun` will fail with `401 Unauthorized` when pulling from `nvcr.io`.
+If `srun --container-image` uses an image from a private registry (e.g., `nvcr.io/nvidia/...`), pyxis/enroot needs registry credentials on the cluster in `~/.config/enroot/.credentials`. See `skills/common/credentials.md` for the NGC / Docker / HF token setup. Without this, `srun` fails with `401 Unauthorized` when the compute node pulls.
 
 Submit and capture the job ID: