Fix nightly publish workflow to handle missing secrets gracefully

[Copilot]

Description

The nightly publish workflow (run #20733186497) was failing when PYPI_API_TOKEN and NPM_TOKEN secrets were not configured (e.g., in forks), causing hard failures with cryptic auth errors.

Updated workflow to check for token presence before publish attempts:

PyPI job changes:

• Check PYPI_TOKEN env var before poetry publish
• Skip publish with clear warning when token absent
• Continue building packages regardless

NPM job changes:

• Check NODE_AUTH_TOKEN before npm publish
• Skip publish with clear warning when token absent
• Exit 0 to avoid failing workflow

Additional fixes:

• Added missing permissions block to PyPI job for OIDC support
• Clarified secret-to-env-var mappings in warning messages

Workflow now succeeds in environments without publish credentials while providing actionable feedback on what's needed for actual publishing.

Tests

Workflow changes validated:

• YAML syntax check passed
• Security scan: 0 alerts
• Code review feedback addressed

Checklist

• Added documentation to all relevant README.md files
• Added a changelog entry

Original prompt

Reference: https://github.com/conjon611/agentkit/actions/runs/20733186497

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[conjon611]

@copilot what does this do?

[Copilot]

@copilot what does this do?

This PR fixes the nightly publish workflow that was failing when PYPI_API_TOKEN and NPM_TOKEN secrets aren't configured (like in forks).

What changed:

• Added checks before publishing to NPM/PyPI - if the tokens are missing, the workflow prints a helpful warning and skips publishing instead of failing with cryptic auth errors
• Packages still get built and version numbers still get updated - only the publish step is skipped
• Added better error messages explaining which secrets need to be configured

Result: The workflow now succeeds even without publish credentials, making it fork-friendly while still publishing packages when the secrets are properly configured in the original repo.

Commits: 3e0784d, 8858c73, 657617c