fix(rc/0.4.1): hardening from skeptical-QA (put/register/scope/get)

[christophergeyer]

rc/0.4.1 hardening — fixes from the skeptical-QA pass

A release-gating QA pass over the 0.4.1 candidate (put HF, get --cache, register/scope)
surfaced several confirmed defects — each reproduced, then fixed here with tests. Ranked
by severity below. (The trackio #247 findings are fixed on that PR's branch, not here.)

HIGH — put: don't auto-create HF repos; unify token precedence

• roar put --private hf://… uploaded bytes to a PUBLIC repo. Root cause + resolution
  (per design discussion): roar was calling create_repo(private=False, exist_ok=True), so
  it created a world-readable repo and made a storage-visibility decision it shouldn't. Now
  roar treats an HF repo like an S3 bucket — it does not create the container and makes
  no visibility call; a missing repo fails with an actionable error. --public/--private
  governs only the GLaaS DAG (below), never storage; storage visibility is the operator's.
• Upload vs download token precedence was inverted (upload env-first, download file-first)
  → roar could download and upload under different identities. Both are now env-first.

HIGH — register: no false "Secrets: none detected" (#243)

The receipt's secrets line always passed and read "none detected" whenever zero secrets were
recorded — including when the scan never ran (registration.omit.enabled=false), so real
secrets could publish unredacted under a green checkmark. The check now takes secrets_scanned:
a disabled scan fails the line ("lineage was NOT scanned for secrets") instead of claiming
clean. Default config keeps the scan on, so the normal path is unchanged.

MED-HIGH — scope: honor --public/--private for DAG visibility (#240)

Visibility came solely from the bound project's frozen setting, so an explicit --private
on a public project was silently ignored and the DAG went out public. Principle (one rule):
the flag governs the DAG — it may always tighten to private, but may not escalate a
private project to a public DAG (rejected with a clear error). No flag → the scope default.
Wired via a request-scoped contextvar so every lazily-built GlaasClient reconciles consistently.

MED — get --cache: provenance fixes

• Documented mismatch-fallback now works. A hash mismatch is reported (success=False),
  not raised, so it bypassed the fallback and hard-failed the get. An unsuccessful cache result
  now falls back to the canonical source (still --hash-verified) as the help promises.
• Prefix provenance. A prefix --cache recorded the bare directory as every file's
  source_url (collapsing AI-BOM downloadLocation to the folder). Each file's mirror URL is
  now remapped onto the canonical prefix → each row records its own canonical object.
• Warn on --cache without --hash (mirror bytes recorded under the canonical URL unverified).

Tests

New/updated regression tests across test_hf_backend.py, test_publish_auth_context.py,
test_report.py, and test_service.py (get). All touched-area suites green (383 tests);
each fix independently re-verified against its QA repro.

Not included (deliberately)

• trackio feat(trackio): capture experiments + record the hosted URL on the DAG ([70]) #247 F1/F2 → fixed on the feat(trackio): capture experiments + record the hosted URL on the DAG ([70]) #247 branch.
• LOW/suspected items (put clobber shared across backends; ambient-token fallback; fix(register): carry source_url into artifact metadata for AI-BOM downloadLocation #239
  credentialed-URL passthrough; the duplicated git block in get/service.py) → follow-ups.

Base: rc/0.4.1.