fix(sdk-pypi): allow dry-run without token

[evanbrown3000]

Reproduction

On current master, call adapter.ship(fakeShipContext({ dryRun: true, secret: () => undefined }), {}). Instead of returning the dry-run preview, sdk-pypi rejects with PYPI_TOKEN not set because it reads and validates the token before checking ctx.dryRun. It therefore cannot preview a PyPI upload without credentials, unlike the other target adapters’ side-effect-free dry-run behavior.

Fix

Resolve the repository and return the existing dry-run result before reading PYPI_TOKEN. Real uploads still require the token and retain the same Twine arguments.

Regression coverage

Added a focused test that supplies dryRun: true with an empty vault and verifies that:

• shipping resolves to the existing dry-run metadata;
• the secret vault is not read; and
• Twine is not invoked.

Verification:

• corepack pnpm exec vitest run packages/targets/sdk-pypi/src/index.test.ts — 1 test passed
• corepack pnpm --filter @profullstack/sh1pt-target-sdk-pypi typecheck — passed
• corepack pnpm --filter @profullstack/sh1pt-target-sdk-pypi build — passed
• corepack pnpm exec vitest run packages/targets — 67 files, 484 tests passed