Use --env instead of --secrets KEY=VALUE for WANDB_API_KEY

The --secrets KEY=VALUE form is not propagating into the container env
in the current hf CLI version (only the bare --secrets HF_TOKEN
auto-inject works). Switch WANDB_API_KEY to --env so it reliably
reaches the container. Tradeoff: value is plaintext in the job UI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/submit_hf_job.sh

@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 # Submit the MutantHunter GRPO training run as an HF Job.
 #
-# Required local env vars (the values are forwarded into the container as
-# secret env vars):
+# Required local env vars:
 #   HF_TOKEN          auto-injected by `hf jobs run` when --secrets HF_TOKEN
 #                     is bare. Make sure you ran `hf auth login` first.
-#   WANDB_API_KEY     forwarded explicitly via --secrets WANDB_API_KEY=$WANDB_API_KEY
-#                     (the auto-inject is HF_TOKEN-only).
+#   WANDB_API_KEY     forwarded as a plaintext --env (the --secrets KEY=VALUE
+#                     form does not propagate reliably in the current CLI).
+#                     The value will appear in the job's env/UI; rotate after
+#                     if concerned. Or pre-store as a named HF secret and
+#                     switch back to bare `--secrets WANDB_API_KEY`.
 
 set -euo pipefail
 
@@ -16,6 +18,6 @@ hf jobs run \
     --flavor a100-large \
     --timeout 6h \
     --secrets HF_TOKEN \
-    --secrets "WANDB_API_KEY=${WANDB_API_KEY}" \
+    --env "WANDB_API_KEY=${WANDB_API_KEY}" \
     pytorch/pytorch:2.5.1-cuda12.4-cudnn9-devel \
     bash -c 'apt-get update && apt-get install -y --no-install-recommends git curl && curl -fsSL https://raw.githubusercontent.com/melohub-xbit/MetaOpenEnv_MutantHunter/main/scripts/run_hf_job.sh | bash'