fix: include HF_TOKEN in secret loading + explicit token pass to HfApi

- start.sh secret loop now includes HF_TOKEN + HUGGING_FACE_HUB_TOKEN
- push-training-to-hf.sh: resolves HF_AUTH from any of 3 env names, passes to HfApi(token=...) instead of relying on default credential lookup
- push script now reports clean error msg on auth failure (was silent 401)

bin/push-training-to-hf.sh

@@ -6,7 +6,7 @@ set -a; source "$HOME/.hermes/.env" 2>/dev/null; set +a
 
 SRC="$HOME/.surrogate/training-pairs.jsonl"
 OFFSET_FILE="$HOME/.surrogate/.training-push-offset"
-LOG="$HOME/.surrogate/logs/training-push.log"
+LOG="$HOME/.claude/logs/training-push.log"
 mkdir -p "$(dirname "$LOG")"
 
 [[ ! -f "$SRC" ]] && { echo "[$(date +%H:%M:%S)] no source $SRC" | tee -a "$LOG"; exit 0; }

start.sh

@@ -67,7 +67,8 @@ mkdir -p ~/.hermes
     for k in OPENROUTER_API_KEY GEMINI_API_KEY GEMINI_API_KEY_2 \
              GITHUB_TOKEN GITHUB_TOKEN_POOL DISCORD_BOT_TOKEN DISCORD_WEBHOOK \
              CEREBRAS_API_KEY GROQ_API_KEY SAMBANOVA_API_KEY \
-             CLOUDFLARE_API_KEY NVIDIA_API_KEY CHUTES_API_KEY ANTHROPIC_API_KEY; do
+             CLOUDFLARE_API_KEY NVIDIA_API_KEY CHUTES_API_KEY ANTHROPIC_API_KEY \
+             HF_TOKEN HUGGING_FACE_HUB_TOKEN; do
         v="${!k:-}"
         [[ -n "$v" ]] && echo "${k}=${v}"
     done