fix(publish): accept Hugging Face artifact sources

[TrevorBasinger]

Summary

• accept hf as a typed GLaaS artifact source
• align the request model with the existing publish normalization and validation paths
• unblock lineage registration after successful roar put ... hf://... uploads

Verification

• pytest tests/core/test_validation_source_types.py — 7 passed
• ruff check . — passed
• mypy roar — passed
• live Open-Sora product path — private HF upload and GLaaS lineage registration completed, reproducibility 7/7

The broader local suite was also attempted from a fresh macOS worktree: 2,403 passed and 41 skipped; 88 tracer tests require the separately built/staged Rust tracer binaries and failed with No tracer binary found.