security: require immutable revision for Hugging Face snapshot prefetches

[patil2001]

Evidence

A public-beta security scan (Bandit B615) found that ods/scripts/download-hf-snapshot.py allows snapshot_download() to resolve the repository's mutable default revision when callers omit --revision. The Linux installer calls this helper without a revision when EMBEDDING_MODEL_REVISION is unset (ods/installers/phases/11-services.sh).

Impact

An embeddings model can change between installs without a pinned commit/hash, weakening reproducibility and supply-chain integrity for a downloaded model artifact.

Duplicate check

• gh issue list --search "download-hf-snapshot revision": no matching issue.
• gh pr list --search "download-hf-snapshot revision": no matching PR.
• gh pr list --search "ods/scripts/download-hf-snapshot.py": no overlapping open fix found.

Suggested fix

Require an explicit immutable revision for production prefetches, or resolve and persist a commit SHA before download. Add a regression test proving an omitted revision is rejected (or that a configured immutable default is used).

Scan evidence

• Commit: 4fa6ad170 (public-beta)
• Tool: Bandit B615, high confidence