market publish rejects valid RAILCALL_API_KEY before the authenticated request

Summary

railcall market publish rejects a valid marketplace API key before it reaches the authenticated request. This breaks the documented headless/CI authentication path.

Reproduction

1. Create a marketplace API key with publish read permissions.
2. Ensure there is no saved interactive marketplace session.
3. Export only the documented variable and run a dry-run publish:

export RAILCALL_API_KEY=rc_ak_live_REDACTED
railcall market publish ./module --type=module --price=0 --dry-run

Actual

The command exits immediately:

Not logged in.
  railcall market login

No authenticated request is attempted.

Expected

RAILCALL_API_KEY should satisfy the publish authentication pre-check and be passed to _marketplace_authed_request(), which already supports API keys.

Code path

_market_publish_module() calls _marketplace_token() as an early guard. _marketplace_token() checks RAILCALL_MARKETPLACE_TOKEN or the saved interactive session, but not RAILCALL_API_KEY. Later, _marketplace_authed_request() correctly prefers RAILCALL_API_KEY, but execution never reaches it.

Workaround

Setting the same API key in both variables allows publishing:

export RAILCALL_API_KEY=rc_ak_live_REDACTED
export RAILCALL_MARKETPLACE_TOKEN="$RAILCALL_API_KEY"

Reproduced while publishing a signed manifest-v2 module. After applying the workaround, the server quality gate passed and the module published successfully.