feat: --dry-run flag on publish CLI

[ziv-lazarov-nagish]

Depends on: #30 — feat/publish-cli

Summary

Fifth of a 5-PR stack (layers 1–4 split #22; this layer adds --dry-run on top as a separate feature). Adds --dry-run to the publish CLI: when set, the pipeline runs through card generation as usual, writes the generated model card to ./publish_dry_run.md (so it can be previewed in an IDE), prints a one-line summary of tag / revision / regression status, and exits before any HF writes.

Stack

5-PR stack — layers 1–4 split #22, layer 5 adds --dry-run:

1. feat/safetensors-runtime → nagish (PR feat: safetensors runtime loading + HF-aware resolver #28)
2. feat/publish-utils-and-card → feat: safetensors runtime loading + HF-aware resolver #28 (PR feat: publish utils — conversion, versioning, model card #29)
3. feat/publish-hf-ops-and-eval → feat: publish utils — conversion, versioning, model card #29 (PR feat: publish HF ops + evaluation helpers #31)
4. feat/publish-cli → feat: publish HF ops + evaluation helpers #31 (PR feat: publish CLI orchestrator #30)
5. This PR → feat: publish CLI orchestrator #30

Test plan

• uv run --extra dev --extra publish pytest sign_language_segmentation/tests/test_publish_cli.py — 5 passed (4 CLI orchestrator + 1 new test_dry_run_writes_card_and_skips_hf)
• uv run --extra dev --extra publish pytest sign_language_segmentation/tests — 106 passed
• uv run --extra dev ruff check sign_language_segmentation/publish/ — clean

[AmitMY]

Approved. Small, clean diff — the dry-run exit is in the right place in the pipeline. Follow-ups (non-blocking): guard against --dry-run --promote dispatching to the real promote path, and clarify in the help text that dry-run still performs HF reads (for version lookup and regression baseline).