fix(ci): move NuGet secret check from if-condition to run script

secrets context not available in step if-conditions, causing workflow parse error.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

.github/workflows/publish.yml

@@ -89,6 +89,12 @@ jobs:
           subject-path: packages/agent-governance-dotnet/nupkg/*.nupkg
 
       - name: Publish to NuGet
-        if: ${{ secrets.NUGET_API_KEY != '' }}
         working-directory: packages/agent-governance-dotnet
-        run: dotnet nuget push ./nupkg/*.nupkg --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
+        env:
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: |
+          if [ -z "$NUGET_API_KEY" ]; then
+            echo "::warning::NUGET_API_KEY not set, skipping NuGet publish"
+            exit 0
+          fi
+          dotnet nuget push ./nupkg/*.nupkg --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate