fix: pass protected project configuration to facts publisher

[Pigbibi]

Summary

• Export the existing protected project Secret under the environment name the account-facts publisher consumes.
• Preserve the GCP authentication setting and scheduled workflow behavior.
• Add a regression that constructs an isolated subprocess environment from the actual publisher job configuration, with synthetic secrets and mocked report reads and publication.

Verification

• Publisher tests: 37 passed.
• Workflow dependency tests: 3 passed.
• The new subprocess regression was reproduced before the fix and passed after it; independently rerun by the primary assistant.
• Ruff, actionlint, Python compilation, and whitespace checks passed.

Real account data, protected values, and broker operations are excluded from the regression. Production publication is validated separately after adoption.