Add HF_TOKEN support for HuggingFace model authentication

[Copilot]

HuggingFace rate limits unauthenticated requests, causing 429 errors when pulling models via docker model pull. Users with HF_TOKEN credentials had no way to authenticate.

Changes

Authentication keychain (pkg/go-containerregistry/pkg/authn/keychain.go)

• Check for HF_TOKEN environment variable when resolving credentials for hf.co and huggingface.co registries
• Set token as RegistryToken which the transport layer formats as Bearer <token> in Authorization headers

Tests (pkg/go-containerregistry/pkg/authn/keychain_test.go)

• Verify HF_TOKEN is used for HuggingFace registries
• Verify other registries remain unaffected
• Verify anonymous access when token is unset

Documentation (README.md)

• Document HF_TOKEN usage and token acquisition

Usage

export HF_TOKEN=hf_your_token_here
docker model pull hf.co/username/model-name

The implementation only affects HuggingFace registry authentication. Other registries and authentication methods (Docker config, Podman auth) are unaffected.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>docker model pull does not appear to use HF_TOKEN environment variable</issue_title>
<issue_description>Hello, and I apologize for multiple issues in a single day.

When pulling good sized models from HuggingFace, it is very easy to hit 429 Too Many Requests, especially on unauthenticated fetches.
Ideally, docker model pull would inspect the environment for HF_TOKEN and pass that along as a Bearer token when making requests to huggingface.

writing blob: get blob contents: GET https://huggingface.co/v2/unsloth/kimi-k2-instruct-0905-gguf/blobs/sha256:c4cb7c5746e236dc288cb74da606d8f49509eaa4df21b853e6476c942726727c: unexpected status code 429 Too Many Requests: {"error":"We had to rate limit your IP (X.X.X.X). To continue using our service, create a HF account or login to your existing account, and make sure you pass a HF_TOKEN if you're using the API."}

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes docker model pull does not appear to use HF_TOKEN environment variable docker/model-runner#441

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.