feat: tag-only mode (no registry publish)

[decofe]

Support projects that release binaries rather than publishing to a registry.

When no crate-token or pypi-token is provided, changelogs publish should still create git tags and GitHub releases without erroring.

This may already work — need to verify. If it does, document it. If not, add a publish-mode: tags-only option.

Needed for foundry-rs/foundry which builds/publishes binaries via a separate release workflow triggered by v*.*.* tags.