Pub/Sub publishers should degrade to noop without GCP credentials (sync + async workers)

[julietshen]

Part of #343.

Osprey's Pub/Sub publishers build their client eagerly in __init__, so they fail when GCP credentials can't be resolved — breaking the default docker compose up experience and any adopter environment without GCP. Both publisher implementations should instead detect missing credentials and degrade to a noop: log a one-time warning, skip building the client, short-circuit publish()/stop(), and emit a noop metric so the inert state is visible in dashboards.

This issue tracks that work across both worker implementations.

Tasks

Sync worker — PubSubPublisher (#388)

osprey_worker/src/osprey/worker/lib/publisher.py

• Detect missing credentials via google.auth.default() (cached, one probe per process)
• Log a one-time warning naming the inert project and topic
• Short-circuit publish() and stop() in noop mode
• Emit a PubSubPublisher.publisher.noop metric, tagged with project and topic
• Unit tests for credential detection and the noop paths

Async worker — AsyncPubSubPublisher

osprey_async_worker/src/osprey/async_worker/lib/publisher.py (separate class, tied to the experimental asyncio worker #341)

• Construction succeeds when GCP credentials are absent (no client built)
• publish() and the flush/stop() paths short-circuit cleanly in noop mode
• One-time warning naming the inert project and topic
• Noop metric per publish attempt, tagged with project and topic (parity with the sync publisher)
• Unit tests for credential detection and the noop paths

Notes

• The credential-detection helper from feat(publisher): degrade PubSubPublisher to noop when GCP credentials are absent #388 could be lifted to a shared location both publishers import, rather than duplicated.
• Broader GCP-eager modules (secret_manager.py, bigquery.py, access_audit_log.py) remain tracked under Make Osprey runnable without GCP credentials (tracking) #343 and are out of scope here.