Add tip for retrieving short-lived HF token via CLI

[coyotte508]

https://moon-ci-docs.huggingface.co/docs/hub/pr_2683/en/trusted-publishers#api-reference

Note

Low Risk
Documentation-only change with no runtime or security behavior impact.

Overview
Adds a TIP in the gated-repo CI section of trusted-publishers.md for workflows that need the exchanged token as a string (e.g. curl, git clone, or tools that read HF_TOKEN).

Documents that hf auth token runs the OIDC exchange and prints the short-lived token to stdout, with a GitHub Actions example that sets HF_OIDC_RESOURCE and writes HF_TOKEN to GITHUB_ENV. Notes that scoping applies to both user and repo publishers via HF_OIDC_RESOURCE.

^{Reviewed by Cursor Bugbot for commit aa30e2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.