GRM-35: feat: fix 12 critical workflow gaps in release pipeline

Addresses all 12 critical gaps in the automated semantic versioning, tagging, and release workflow.

Closes GRM-35

.gitea/workflows/publish.yml

@@ -26,6 +26,11 @@ jobs:
       - name: Install build tools
         run: |
           python3 -m pip install --break-system-packages build twine requests python-dotenv click
+      - name: Validate PYPI_TOKEN
+        run: |
+          if [ -z "${{ secrets.PYPI_TOKEN }}" ]; then
+            echo "::warning::PYPI_TOKEN is not set — package will be built but not published to PyPI."
+          fi
       - name: Build and publish release
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
@@ -35,3 +40,14 @@ jobs:
           python3 scripts/publish.py \
             "${{ github.ref_name }}" \
             "${{ github.repository }}"
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          python3 scripts/notify_failure.py \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "publish" \
+            --commit "${{ github.sha }}"