Docs: explain local, remote, and publish validation

[zkwentz]

What & Why

Authors need a clear mental model for local iteration, remote author validation, strict publishing, and future independent Hub certification. This PR updates CLI, builder, contributor, and template documentation to describe those boundaries and the task.toml migration.

Risk & Review Guidance

• Risk level: LOW — documentation and command docstrings only
• Task class: docs
• Review focus: docs/source/reference/cli.md:43 for profile/remote semantics; docs/source/getting_started/contributing-envs.md:49 for the publish flow; template README synchronization
• Blast radius: Misleading docs could cause users to mistake author evidence for certification or omit required configuration.

Decisions & Alternatives

• Use future tense for Hub certification — rejected implying the coordinator is already deployed.
• Call out legacy task.toml migration explicitly — authors should provide truthful settings, not copy placeholders.
• Keep both generated README templates identical — avoids scaffold/documentation drift.

Verification

• PASS: PYTHONPATH=src:envs .venv/bin/python -m pytest tests/ -q -m 'not integration' — 1,559 passed, 114 skipped, 31 external integration tests deselected on the complete stack.
• PASS: Fork whole-stack CI — 7/7 checks passed, including Python 3.11/3.12, lint, docs, lock validation, and package smoke tests.
• NOT verified: No live HF Sandbox example was recorded because this machine has no HF token.

Scope & Non-Goals

• No runtime behavior changes beyond docstrings.

Stack

PR 17 of 17; depends on #957.

Full 17-PR stack

1. #942 RFC 008: Spec-neutral local and remote validation architecture
2. #943 Validation foundation: spec-neutral contracts and adapters
3. #944 Validation policy: spec-aware check registry and planner
4. #945 Validation executor: hardened shared reports and eligibility
5. #946 Local validation API: execution-model-aware profiles
6. #947 CLI: validation profiles and shared reports
7. #948 HF runtime: dedicated sandbox execution mode
8. #949 HF certification: enforce trusted dedicated isolation
9. #950 [RFC 008] Define remote author validation and publish gating
10. #951 Validation: unify CLI reports and add a strict publish profile
11. #952 Validation: add structured author diagnostics and remediation
12. #953 Validation: run author validation in dedicated HF Sandboxes
13. #954 Validation: isolate submitted code in author Sandboxes
14. #955 Validation: bind author reports to policy and source
15. #956 CLI: scaffold publish requirements
16. #957 CLI: gate pushes on staged remote validation
17. #958 Docs: explain local, remote, and publish validation ← current

All upstream PRs remain draft while RFC 008 is under review.