Simplify setup and link the training tutorial and model weights

[Nutlope]

Previously, uv sync --locked omitted the Together SDK and tg CLI because they were optional training dependencies. Make the pinned Together SDK a standard dependency so the tutorial's basic setup installs both.

Update the lockfile, README, training guide, contribution instructions, and CI to use the simpler commands. The SDK serialization test now fails if the required dependency is missing instead of skipping.

Add prominent links near the top of the README to the full $17 classifier training tutorial and the Hugging Face model weights, replacing the outdated announcement of a forthcoming blog post.

Validation: uv sync --locked --offline succeeds; uv run --locked --offline tg --version reports 2.23.0; all 25 tests pass for the dependency change. The subsequent README-only change passes git diff --check.

[broly-code-security-scanner]

Broly Security Scan

Note

Summary

1 actionable finding(s) in this PR

• 🟡 1 medium

Main table: 1 shown, 0 omitted of 1 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟡 MEDIUM	SCA	PYSEC-2026-3716: datasets@4.8.5 → >= 5.0.1	uv.lock:1	d1	🔺 TRUE_POSITIVE · Confidence: MEDIUM

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟡 MEDIUM   · uv.lock:1 · PYSEC-2026-3716: datasets@4.8.5

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (DeepSeek-V4.1-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.