Allow publish scripts to use GitHub Actions secrets when k2f-private/.env
is not present locally in the runner checkout.

Co-authored-by: Cursor <cursoragent@cursor.com>