ci: document central token publishing

Author: javorosas

.github/workflows/publish.yml

@@ -93,6 +93,9 @@ jobs:
 
       - name: Publish
         if: steps.gate.outputs.publish == 'true'
+        # Central publishing uses the Sonatype Portal token configured in repository secrets.
+        # GPG signing is intentionally omitted in this workflow; if Central changes its requirements,
+        # reintroduce it here and in the release profile.
         run: mvn -B -ntp -DskipTests -DpublishRelease=true deploy
 
       - name: Skip publish