Clean up dead publishing repository config and credentials in subproject build files

## Summary

Both `agent/build.gradle` and `bootstrap-api/build.gradle` (added in #293) contain a `publishing.repositories.maven` block that is never used during the actual release flow. This dead configuration includes hardcoded credential lookups and a legacy Sonatype URL.

## Details

The actual publish path uses the **root-level `nexus-publish-plugin`** (`io.github.gradle-nexus.publish-plugin`), which creates its own `publishToSonatype` task targeting:

```
https://ossrh-staging-api.central.sonatype.com/service/local/
```

Credentials are passed via `-PsonatypeUsername` / `-PsonatypePassword` in the `Makefile`.

However, both subprojects define their own `publishing.repositories.maven` block pointing to a **different, legacy URL**:

```
https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/
```

with credentials sourced from `nexusUsername` / `nexusPassword` properties (which are never provided in the Makefile).

This config is dead code — it would only be invoked if someone ran `./gradlew publish` directly instead of `publishToSonatype`, which is not the intended flow. Having it around is confusing and could cause mistakes if someone tries to publish manually.

## Affected files

- `agent/build.gradle` — `publishing.repositories` block (lines ~93-101)
- `bootstrap-api/build.gradle` — `publishing.repositories` block (added in #293)

## Suggestion

Remove the `publishing.repositories.maven` block (and the dead `nexusUsername`/`nexusPassword` credential lookups) from both subproject build files. The nexus-publish-plugin in the root `build.gradle` handles repository configuration for the actual publish flow.