Handle missing HUGGING_FACE_TOKEN gracefully in CI

[MaxGhenis]

Summary

• CI workflows now handle missing HUGGING_FACE_TOKEN gracefully
• Fixes the httpx.LocalProtocolError: Illegal header value b'Bearer ' error that occurs when Dependabot PRs run without access to secrets

Problem

When Dependabot opens a PR, it doesn't have access to repository secrets. The HUGGING_FACE_TOKEN secret gets passed as an empty string, which causes:

1. policyengine-core to return "" (empty string is not None)
2. huggingface_hub to create a Bearer header (empty token)
3. httpx to fail with Illegal header value

Solution

Pass the token through an intermediate env var (HF_TOKEN_VALUE) and only export it to HUGGING_FACE_TOKEN if non-empty:

if [ -n "$HF_TOKEN_VALUE" ]; then
  export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
fi

This allows tests that don't need microdata downloads to still pass.

Test plan

• CI passes on this PR (won't have access to token either, ironically)
• After merge, verify Dependabot PRs can run tests

🤖 Generated with Claude Code