fix(publish): report a missing KMS secret instead of dying at exit 22

The first run of the KMS-backed job ended at `exitcode '22': failure` with no
error line in the log. That reads like a network fault or bad credentials. It
was neither: KMS login succeeded, and the SECRET FETCH 404'd because the path
`hanzo/prod/python-sdk-publish` has never been seeded.

The step runs under `bash -e -o pipefail`, so `curl -sf` on an absent path exits
22 and kills the step before the guard below it can say anything. The guard I
added in the previous commit was therefore unreachable — it could never fire on
the one condition it exists to explain.

The fetch now captures the HTTP status instead of failing the shell, so an
unseeded key prints its status and the guard reports which path is empty.
Credentials are unchanged and still masked; only the diagnosis changes.

Proof this is a path problem and not a credential one: hanzoai/extension runs the
identical login against the identical org-level KMS_CLIENT_ID/KMS_CLIENT_SECRET
(the only copy that exists on the forge) and gets past it — its `extension-publish`
path is seeded, so its publish reaches the packaging step.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/publish-pypi.yml

@@ -117,10 +117,23 @@ jobs:
           # Two tokens cover per-project scope: PYPI_TOKEN owns most hanzo-*
           # packages, HANZO_AI_PYPI_TOKEN the rest. Each upload tries the primary
           # then falls back, so a 403 scope-miss on one is covered by the other.
+          #
+          # `|| true` on the fetch, deliberately. The step runs under
+          # `bash -e -o pipefail`, where `curl -sf` on an ABSENT path exits 22 and
+          # kills the step instantly — before any message of ours can print. That
+          # is exactly what happened on the first run of this job: the log ended at
+          # `exitcode '22': failure` with no error line, which reads like a broken
+          # network or bad credentials and is neither. It was a 404 for a KMS path
+          # that has not been seeded yet. A missing secret must be diagnosable, so
+          # the HTTP status is captured and reported by the guard below instead.
           for KEY in PYPI_TOKEN HANZO_AI_PYPI_TOKEN; do
-            VAL=$(curl -sf "$KMS/v1/kms/orgs/$ORG/secrets/$P/$KEY?env=$ENVN" \
-              -H "Authorization: Bearer $TOKEN" | jq -r '.secret.value // empty')
-            if [ -n "$VAL" ]; then echo "::add-mask::$VAL"; fi
+            BODY=$(curl -s -w '\n%{http_code}' "$KMS/v1/kms/orgs/$ORG/secrets/$P/$KEY?env=$ENVN" \
+              -H "Authorization: Bearer $TOKEN") || true
+            CODE=$(printf '%s' "$BODY" | tail -1)
+            VAL=$(printf '%s' "$BODY" | sed '$d' | jq -r '.secret.value // empty' 2>/dev/null || true)
+            if [ -n "$VAL" ]; then echo "::add-mask::$VAL"; else
+              echo "note: KMS returned HTTP $CODE for $ORG/$ENVN/$P/$KEY (no value)"
+            fi
             echo "$KEY=$VAL" >> "$GITHUB_ENV"
           done