Ship the accepted flash head (gate nano_ordtext_wd05_mps_hf) with the runtimes and card re-derived from those bytes

README.md

@@ -254,6 +254,8 @@ Top-1 / top-3 are exact match; ECE (95% CI 0.0154–0.0243), Brier and NLL are t
 | **C++ LibTorch (TorchScript)** | [`model.torchscript`](https://huggingface.co/Tamkimd/tamev-nano-flash-tinybert/resolve/main/model.torchscript) | 55.1 MiB |
 
 > Sizes are the files in this repository, in MiB. ONNX FP16 is a cast of the FP32 graph (not a re-export) at half the download, and picks the same answer on 512 sampled gate items.
+> The Hub marks this file **Suspicious** (Protect AI `PAIT-TCHST-301`): a TorchScript archive is a ZIP of pickles, so the container alone puts every one of them in scope for a code-execution finding, whatever is inside — the same scan passes this repository's `model_mps_fp16.pt`, which is a real pickle. This one was audited statically rather than loaded: all 101 callables across 3 pickle members are `torch` types, and the 80 TorchScript source files (77,598 characters) contain no file, process or network primitive and no custom operators. The audit disassembles the pickles rather than loading them, so running it cannot execute what it inspects, and it ships with the source distribution. The file it covers is sha256 `6d469ef4cb7e`.
+
 
 ```bash
 hf download Tamkimd/tamev-nano-flash-tinybert --local-dir ./tamev-nano-flash-tinybert