publish-jobs: check if appropriate secrets are set early

It would be great if the `plan` step could check if `secrets.blahblah` was properly set when you have a publish-job that requires it (homebrew, crates.io (#405), and npm (#406) all define their own). That way we can help someone who sets the tasks up and forgets to actually setup the secrets.

Note however that pull-request CI runs on the repo that is *submitting* the pull-request, and as such secrets aren't defined on there if it's from a fork (good, correct). So we can only enable this check if it's on the main repo. This may be an argument for having `plan` also run `on: push (not a tag)`..?

Start by tracing the plan step and the publish-job definitions for homebrew, crates.io (#405), and npm (#406). Check how pull-request CI distinguishes the main repository from forks and how workflow triggers are represented; done means the plan step safely reports missing required secrets only in the main repository without breaking fork PR CI.

Written by the indexing model from the issue text.