fix: verify URL uses source@hash for direct fetch

README.md

@@ -72,13 +72,13 @@ license: apache-2.0
 
 
 <p align="center">
-<a href="https://cambriantech.github.io/forge-alloy/verify#857b4ca12cb7108d">
+<a href="https://cambriantech.github.io/forge-alloy/verify/#huggingface.co/continuum-ai/qwen3.5-4b-code-forged/resolve/main/qwen3.5-4b-code-forged.alloy.json@435ff486e11ed54d">
 <img src="alloy-qr.png" alt="Verify Chain of Custody" width="160"/>
 </a>
 </p>
 
 <p align="center">
-<a href="https://cambriantech.github.io/forge-alloy/verify#857b4ca12cb7108d"><b>Every claim on this card is verified</b></a><br>
+<a href="https://cambriantech.github.io/forge-alloy/verify/#huggingface.co/continuum-ai/qwen3.5-4b-code-forged/resolve/main/qwen3.5-4b-code-forged.alloy.json@435ff486e11ed54d"><b>Every claim on this card is verified</b></a><br>
 <b>Trust: self-attested</b> · 2 benchmarks · 1 device tested<br>
 <a href="https://github.com/CambrianTech/forge-alloy">ForgeAlloy</a> chain of custody · <a href="qwen3.5-4b-code-forged.alloy.json">Download alloy</a> · Merkle-chained
 </p>
@@ -136,7 +136,7 @@ Produced via GGUF quantization. Full methodology, ablations, and per-stage ratio
 
 ## Chain of Custody
 
-Scan the QR or [verify online](https://cambriantech.github.io/forge-alloy/verify#857b4ca12cb7108d). Download the [alloy file](qwen3.5-4b-code-forged.alloy.json) to verify independently.
+Scan the QR or [verify online](https://cambriantech.github.io/forge-alloy/verify/#huggingface.co/continuum-ai/qwen3.5-4b-code-forged/resolve/main/qwen3.5-4b-code-forged.alloy.json@435ff486e11ed54d). Download the [alloy file](qwen3.5-4b-code-forged.alloy.json) to verify independently.
 
 | What | Proof |
 |------|-------|