Map VSCE_PAT to job-level env and gate the Marketplace publish step on
env instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>