Trusted Publishers: use the hf CLI for the OIDC exchange

[hanouticelina]

follow-up PR after huggingface/huggingface_hub#4326, which added native oidc token-exchange (Trusted Publishers) support in huggingface_hub. this PR updates the Trusted Publishers guide accordingly.

⚠️ Merge after huggingface_hub 1.19.0 ships

---

Note

Low Risk
Documentation-only changes to the Trusted Publishers guide; no runtime or security logic in this repo.

Overview
Updates the Trusted Publishers guide (docs/hub/trusted-publishers.md) so CI examples use the hf CLI (huggingface_hub>=1.19.0) for OIDC token exchange instead of manual curl/jq calls to /oauth/token and HF_TOKEN in the environment.

The GitHub Actions quick start now installs the CLI via the install script, sets HF_OIDC_RESOURCE for the target repo, and runs hf upload directly. New guidance covers multi-repo runs (per-step HF_OIDC_RESOURCE) and an Other CI providers section with a GitLab example using HF_OIDC_ID_TOKEN plus HF_OIDC_RESOURCE.

The gated repos flow is rewritten the same way: GitHub Actions uses HF_OIDC_RESOURCE with hf download; other providers pass the minted ID token via HF_OIDC_ID_TOKEN.

^{Reviewed by Cursor Bugbot for commit 3afd45b. Configure here.}

[coyotte508]

btw maybe change acme by something else

[Wauplin]

(release should be happening soon :) )

[coyotte508]

merging due to release

[coyotte508]

ah sorry 🤦

saw slack message thought it was released

[hanouticelina]

No worries!