* Publish workflow: use default GITHUB_TOKEN for checkout, drop unused PAT_GITHUB_ADMIN.

* nx:fix: skip when nothing was built (workflow-only changes leave no dist/packages).

Bring the plan in line with what increments 1 and 3 actually shipped, and settle
the increment 4 design against the published SDKs.

algokit-utils cannot emit a pqsig envelope in any released version - checked
through 10.0.0-beta.4, the newest on npm - so increment 4 cannot be written
against the packages currently installed. algosdk 3.7.0 has the full feature:
SignedTransaction.pqsig, EncodedPQSig, addressFromPQKey/addressFromPQSig, an
async remote-signer adapter shaped like a Vault call, and an empty-signature
signer that makes algod report the real post-quantum fee under simulate.

Adding algosdk 3.7.0 is therefore a hard prerequisite for increment 4, scoped to
the PQ envelope and address helpers only; transaction building, grouping and
encoding stay on algokit-utils. That supersedes the earlier plan to hand-assemble
the envelope and promote algorand-msgpack to a direct dependency - hand-rolling
canonical msgpack on a money path is the wrong trade when the SDK's own schema
encoder is available.

The two SDKs interoperate at the byte level, verified against the real packages:
algosdk decodes algokit's encoded transaction (TX prefix stripped) and re-encodes
it byte-identically, its bytesToSign output matches algokit's encodeTransaction
exactly, an ed25519 signed transaction encodes identically under both, and the PQ
address helpers agree with the Vault plugin's derivation.

The rest tracks reality: increment 4 is no longer blocked on an unavailable algod
version now that v5 is released, the increment 1 notes describe the plugin
version pinning and mount verification that were built, account_type is required
rather than optional, the signing call sites still discard the resolved
UserAccount, and the review findings increment 4 has to clear are listed
explicitly alongside the non-atomic cross-mount check left for cleanup.