Matches taskweft/nif and taskweft/mcp's convention: mix hex.publish runs
non-interactively via the org-level HEX_API_KEY secret on a version tag
push, instead of the interactive OTP/2FA prompt. This repo never got this
workflow when the others did.