For anyone else reading this: I couldn’t find a good solution this for my situation, so I ended up running my Gradio application on one of the well known PaaS providers. Works quite well with github integration, just had to set a few environment settings.
I do want to stress that I’m still a huge fan of Huggingface, and it may not make sense for the platform to support the “stealth” scenario I describe above.