fix(ci): repair publish and SBOM workflow failures

- publish.yml: add fail-fast: false so all PyPI packages publish even if one fails
- publish.yml: guard NuGet publish with secret check + quote API key
- sbom.yml: fix attest-sbom v2 inputs (sbom-path instead of sbom-format)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

.github/workflows/publish.yml

@@ -29,6 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     strategy:
+      fail-fast: false
       matrix:
         package: [agent-os, agent-mesh, agent-hypervisor, agent-sre, agent-compliance]
     steps:
@@ -88,5 +89,6 @@ jobs:
           subject-path: packages/agent-governance-dotnet/nupkg/*.nupkg
 
       - name: Publish to NuGet
+        if: ${{ secrets.NUGET_API_KEY != '' }}
         working-directory: packages/agent-governance-dotnet
-        run: dotnet nuget push ./nupkg/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
+        run: dotnet nuget push ./nupkg/*.nupkg --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate

.github/workflows/sbom.yml

@@ -43,7 +43,7 @@ jobs:
         uses: actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2.2.0
         with:
           subject-path: sbom.spdx.json
-          sbom-format: spdx+json
+          sbom-path: sbom.spdx.json
 
       - name: Upload SBOMs to release
         if: github.event_name == 'release'