Gate publishing on protected integration tests

[jformacek]

The release workflow currently runs integration-tagged tests without access to the protected configuration, causing federated authentication to fail before signing and publishing. This separates credentialed integration coverage from the release job and makes it an explicit publishing gate.

Changes

• Add a protected integration job using the confidential-client-integration GitHub Environment and OIDC permission.
• Require both client-secret and federated credential tests to pass before the publish job proceeds.
• Keep the Windows release job secret-free and run only non-integration Pester coverage there.
• Skip federated tests consistently when their GitHub OIDC configuration is unavailable outside integration jobs.
• Allow v* release tags to use the protected integration environment.

Validation

A non-publishing manual rehearsal completed successfully with both the confidential-client integration job and the full publishToGallery job passing.