Bring hf-publish/ staging into the repo: single-source cards, publish script, drift check

[caiotheodoro]

Context

The publication pipeline is untracked and manual. The live dataset card, CHANGELOG.md, metrics/definitions.md, metrics/weights.json, and scripts/{generate,evaluate,contamination_check}.py exist only in /Users/caiotheodoro/Documents/personal/hf-publish/ — a directory that is not a git repo. No huggingface_hub/HfApi/upload_folder usage exists anywhere in reconforge. Card drift is already real: hf-publish/reconforge-recon-lora/README.md is 3 hunks behind reconforge/model/README.md. Every card fix in the other issues will be hand-copied twice unless this is fixed first — which is why this issue should land before the wave of card edits.

Evidence

• ls /Users/caiotheodoro/Documents/personal/hf-publish/ — recon-eval/ and reconforge-recon-lora/ staging dirs; git -C .../hf-publish status → not a repository.
• diff reconforge/model/README.md hf-publish/reconforge-recon-lora/README.md — 3 hunks.
• grep -rn "huggingface_hub\|HfApi\|upload_folder" reconforge/ — no hits.

Task

1. Move the staging content into the repo: publish/recon-eval/ and publish/reconforge-recon-lora/ (or make model/README.md the single source and generate the staging copy).
2. Write scripts/publish.py using huggingface_hub.upload_folder with explicit repo_id, revision tagging, and a --dry-run diff mode.
3. Single-source the cards: the model card lives at model/README.md only; publish script pushes it. Kill the second copy.
4. Add a drift check (used by the CI issue): publish.py --check fails if the Hub card differs from the repo card.
5. Bring metrics/definitions.md + weights.json under the repo and link them from both cards (this also closes spec §11.7).

Acceptance criteria

• hf-publish/ contents tracked in reconforge; one canonical card file per artifact.
• python scripts/publish.py --dry-run shows a clean diff against the live Hub repos.
• Drift check exists and passes.

Dependencies

Do this before the T0 card-fix issues are pushed to the Hub, so those fixes flow through the tracked pipeline instead of adding one more manual copy.

Cost tier

T1-cheap — file moves + one small script; Hub uploads are free.