sec: harden modal worker, update deployment docs, and add pre-push safety checks

NaturalCAD: final HF runtime attempt with pure pip stack

NaturalCAD: use strict conda-forge runtime for HF Space

NaturalCAD: simplify HF CAD runtime and add smoke test

NaturalCAD: expose Conda lib path for HF runtime

NaturalCAD: add hosted backend flow and Space fixes

Initial NaturalCAD MVP