Add QPK dependency for monthly publish

[Pigbibi]

Summary

• add quant-platform-kit to requirements and requirements-lock for real monthly publish
• upgrade the monthly publish WIF auth action to v3
• update workflow config tests to require WIF and lock the QPK dependency

Root cause

After the GCP WIF condition was fixed, the monthly publish run advanced to real release publishing and failed with ModuleNotFoundError: No module named quant_platform_kit. src/publish.py imports quant_platform_kit.cloud for GCS and Firestore writes, but the monthly publish dependency install only used requirements-lock.txt, which did not include QPK.

Verification

• git diff --check
• python3 -m unittest tests.test_monthly_publish_workflow_config -v
• uv run --with pip python -m pip install --dry-run -r requirements-lock.txt

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5ef7666d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Re-authenticate closer to the publish step

With the new Workload Identity Federation setup, the google-github-actions/auth docs warn that the GitHub OIDC token and derived credentials expire after about 5 minutes; in this workflow the only Google Cloud work happens later in Publish Production v1 Release, after dependency install, history download, and the monthly shadow build. When those pre-publish steps take more than a few minutes, the publish script will try to upload to GCS/Firestore with expired ADC credentials, so move this auth step immediately before publishing or refresh credentials there.

Useful? React with 👍 / 👎.