feat(neuron): honour HF_HUB_CACHE / HF_HOME for the candle harness cache

Resolves the candle harness's HuggingFace cache directory with the
following precedence (first hit wins):

1. Explicit `hf_cache` in `[harness.candle]` from neuron.toml.
2. `HF_HUB_CACHE` env var — the Python `huggingface_hub` convention.
   The Rust hf-hub crate doesn't read this natively, so we bridge here.
3. `HF_HOME` env var (`$HF_HOME/hub` per the canonical layout).
4. None — falls through to hf-hub's own default.

Honouring HF_HUB_CACHE lets a neuron host reuse an existing cache
directory shared with Python tooling or other harnesses on the same
host without per-tool config. The canonical per-host setup is a
systemd drop-in:

    /etc/systemd/system/neuron.service.d/local.conf
    [Service]
    Environment=HF_HUB_CACHE=/archive/hf-cache

neuron.example.toml documents the resolution chain inline.

script/validate-neuron.sh: bump LOAD_TIMEOUT from 600s to 3600s and
expose both load/infer timeouts via env (NEURON_LOAD_TIMEOUT,
NEURON_INFER_TIMEOUT). A Qwen3.6-class dense model is ~54 GB and was
hitting the 10-min ceiling cold-downloading on a residential link.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

script/validate-neuron.sh

@@ -45,11 +45,15 @@ EXPECT_SUBSTR='Tbilisi'
 MAX_TOKENS=256
 
 # /models/load is synchronous — neuron blocks the response until the
-# hf-hub download + GGUF parse + tensor materialisation is done. A
-# fresh 0.6B-Q4_K_M is ~400 MB; on a slow link or cold cache that's
-# easily a minute. Pick a generous ceiling.
-LOAD_TIMEOUT=600
-INFER_TIMEOUT=120
+# hf-hub download + (GGUF parse or safetensors mmap) + tensor
+# materialisation is done. Small GGUF (0.6B-Q4_K_M, ~400 MB) is
+# typically a minute on a warm cache, several on a cold one. A
+# Qwen3.6-class dense model is ~54 GB and can easily take an hour to
+# download cold over a residential link, so default high. Override
+# with NEURON_LOAD_TIMEOUT=N (seconds) for smaller targets if you'd
+# rather fail fast.
+LOAD_TIMEOUT="${NEURON_LOAD_TIMEOUT:-3600}"
+INFER_TIMEOUT="${NEURON_INFER_TIMEOUT:-120}"
 
 # Status messages go to stderr so command substitutions like
 # `raw=$(run_probe)` capture only the function's intended return value