FIX GCG: forward hf_token as None instead of an empty string

[immu4989]

Fixes #2274.

GCGGenerator._to_attack_params built the attack params with token=self._hf_token or "". Since hf_token defaults to None (correct for a public model), the or "" turned it into an empty string, which huggingface_hub sends as Authorization: Bearer with no credential. httpx rejects that as an illegal header, so GCG could not load any ungated model:

_StrategyRuntimeError: Strategy execution failed for GCGGenerator: Illegal header value b'Bearer '

None is HuggingFace's value for anonymous access, so it is forwarded unchanged now.

Changes

• generator.py: forward self._hf_token as-is instead of coercing None to "".
• attack_manager.py: widen ModelWorker.__init__'s token parameter to str | None, matching what is now passed.
• test_generator.py: new TestToAttackParamsToken covering both the absent-token and supplied-token cases.

The absent-token test fails on the current code with assert '' is None and passes with the fix, so it pins the regression.

Verification

pytest tests/unit/executor/promptgen/gcg
=> 199 passed

pre-commit run
=> all hooks passed, including ruff and ty

I am separately setting up a run against TinyLlama/TinyLlama-1.1B-Chat-v1.0 on a free GPU to confirm the full load path end to end, and will post that here once it completes. The unit coverage above pins the specific defect regardless.

[romanlutz]

Good catch! Thanks @immu4989