Firm says ‘early signals … could have triggered an earlier response’ as it releases report into Hugging Face hack