[codex] Document optional signing key id

[FakeGeek92]

Summary

• Document SIGNING_KEY_ID as optional for PublishPlugin Central release setup.
• Keep the signing key id normalization fallback covered by workflow/script tests.

Validation

• python3 .github/scripts/ensure_publish_version_test.py
• python3 .github/scripts/normalize_signing_key_id_test.py
• python3 .github/scripts/sync_readme_publish_version_test.py
• python3 .github/scripts/publish_plugin_central_workflow_test.py
• ./gradlew :plugin_base:build --stacktrace
• ./gradlew :plugin_base:publishToMavenLocal --stacktrace
• python3 .github/scripts/validate_publish_plugin_publications.py
• python3 .github/scripts/sync_readme_publish_version.py --check
• ./gradlew :plugin_base:publishAllPublicationsToCentralStagingRepository -PcentralPublish=true --dry-run --stacktrace

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06102aecde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not mark SIGNING_KEY_ID optional for callers

In the business-project reusable workflow section, this says SIGNING_KEY_ID can be omitted, but .github/workflows/central-publish.yml still declares SIGNING_KEY_ID as a required workflow_call secret and always maps it into ORG_GRADLE_PROJECT_signingInMemoryKeyId. If an org follows this doc and removes that secret while calling the workflow with secrets: inherit, the reusable workflow fails validation before Gradle can infer the key id. Either make the reusable workflow treat the secret as optional/normalize it there, or keep this secret documented as required for callers.

Useful? React with 👍 / 👎.