Push skills unsigned until keyless signing lands

[samuv]

Summary

• The skills build/publish workflow has been failing on every push-enabled run since the skill-push signing requirement landed: pushing now requires either --key or --no-sign, and this workflow passed neither, so every push errors with signing key required.
• Keyless push signing (Keyless OIDC push signing for thv skill push #6307) is in progress but not yet shipped (gated on a toolhive-core release), so as an interim fix, pass --no-sign to both thv skill push invocations to unblock CI. A TODO(#6307) marks where to switch to real signing once it lands.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Test plan

• Reviewed the workflow diff manually; change is scoped to adding --no-sign to the two existing thv skill push calls, no other behavior changes.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.92%. Comparing base (8f294e2) to head (7b5d36f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6334      +/-   ##
==========================================
- Coverage   72.96%   72.92%   -0.05%     
==========================================
  Files         742      742              
  Lines       78236    78236              
==========================================
- Hits        57088    57053      -35     
- Misses      17168    17201      +33     
- Partials     3980     3982       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.