Fix publish workflow auth by supporting VSCE_PAT with backward-compatible fallback

[Copilot]

Release and publish extension started failing at the Marketplace publish step with 401 Unauthorized. The failure was caused by strict dependency on a single secret name for the VS Marketplace PAT.

• Root cause

  • Publish job only read secrets.PUBLISHER_KEY for HaaLeo/publish-vscode-extension.
  • If the environment is configured with VSCE_PAT (common naming), the action receives no valid token and returns 401.

• Workflow change

  • Updated publish token wiring in .github/workflows/publish.yml to prefer VSCE_PAT and fall back to PUBLISHER_KEY.
  • Preserves existing behavior while restoring compatibility with current secret naming.

• Resulting behavior

  • Publish step can authenticate when either secret is configured.
  • No change to release artifact creation or publish action version.

with:
  pat: ${{ secrets.VSCE_PAT || secrets.PUBLISHER_KEY }}
  registryUrl: https://marketplace.visualstudio.com
  extensionFile: ./vscode-github-actions-${{ needs.release.outputs.version }}.vsix