fix: decode base64 PGP key before signing (KOJAK-35) (#19)

## Summary
- SML org-level `PGP_SECRET` is base64-encoded (sbt ci-release
convention)
- vanniktech expects raw ASCII-armored key
- Added decode step in publish job before
`publishAndReleaseToMavenCentral`
- Key decoded in memory, written to `$GITHUB_ENV`, temp file removed

## Context
v0.1.0 tag CI failed with: `secret key ring doesn't start with secret
key tag: tag 0xffffffff`

## Test plan
- [ ] CI passes on this PR
- [ ] After merge: tag v0.1.1, verify publish job succeeds