forked from 1b-agent/opencadstudio-upstream
Step-level if: conditions cannot read the secrets context, which made GitHub reject the workflow file outright (startup failure, zero jobs). The signing waterfall now keys off job-level env booleans mirrored from the credential secrets - a pattern actionlint accepts.