feat: add xtap pool setup wizard

[osolmaz]

Summary

Pool owners had to stitch together the xTap pool setup by running scripts and copying manual follow-up steps.
This change adds an interactive TypeScript setup wizard that creates or updates the Hugging Face resources, configures the Space, verifies the dataset-only token, and optionally seeds existing xTap exports.
It also wires the new setup workspace into local checks, CI, coverage, and the README owner flow.

What Changed

The owner setup path is now a first-class npm workspace instead of only a shell-script checklist.
The wizard keeps the existing lower-level scripts available, but guides the normal path through prompts and validation.

• Added setup/, a private TypeScript workspace with a Clack-based CLI entrypoint.
• Added Hugging Face Space variable/secret helpers and dataset-only token verification against whoami-v2.
• Added staging/deploy helpers that upload a committed Space archive, use the Space README, and omit local-only folders.
• Added unit tests for config defaults, token validation, Hub API calls, process helpers, root discovery, and Space staging.
• Added setup workspace checks to root Vitest, slophammer, and CI.
• Updated the README to point pool owners at npm run setup while keeping the lower-level scripts documented.

Testing

I ran the repo-level gates and the workflow mutation gates locally.
The interactive Hugging Face mutation flow itself was not run against production resources, but the non-interactive helpers and compiled root discovery path were tested.

• npm run check passed.
• npm run build passed.
• npm run mutate passed.
• npm run mutate --workspace shared passed.
• npm run mutate --workspace space passed.
• npm run mutate --workspace explorer passed.
• node -e "const m=await import('./setup/dist/src/root.js'); console.log(m.findProjectRoot(new URL('./setup/dist/src/', import.meta.url).pathname))" printed /Users/onur/repos/xtap-pool.

Risks

The main risk is API drift in Hugging Face token or Space secret endpoints.
The code keeps those calls isolated in setup helpers and tests the shapes we depend on, but a live setup run is still the final verification for a real owner account.

[osolmaz]

Final validation report for head 8c27ffb3846e10529c9ae29bdcc31b65fd0ca153:

• npm run check passed
• npm run build passed
• git diff --check passed
• npm run coverage --workspace setup passed
• npm run dry --workspace setup passed
• npm run mutate --workspace setup passed with mutation score 73.13, above the 60 break threshold
• staged Space Docker build passed from the generated upload context
• codex review --base main completed with no actionable correctness issues
• GitHub CI check passed

Note: the review sandbox could not run Vitest because it is read-only and Vite needs to write a temp config cache; the same test suite passed in the normal local environment and in GitHub CI.