fix: isolate Maven Local from release signing

platform/android/buildSrc/src/main/kotlin/maplibre.gradle-publish.gradle.kts

@@ -4,6 +4,7 @@ import org.gradle.api.Task
 import org.gradle.api.tasks.compile.JavaCompile
 import org.gradle.external.javadoc.StandardJavadocDocletOptions
 import org.gradle.kotlin.dsl.get
+import org.gradle.plugins.signing.SigningExtension
 import java.util.Locale
 
 plugins {
@@ -16,6 +17,13 @@ plugins {
 
 val androidComponents = extensions.getByType<LibraryAndroidComponentsExtension>()
 val androidLibrary = extensions.getByType<LibraryExtension>()
+// Gradle SigningExtension evaluates this Provider when a Sign task executes. Maven Local keeps
+// the release coordinate but does not need a PGP signatory; Maven Central publication does.
+val signingRequiredForMavenCentral = providers.provider {
+    gradle.taskGraph.allTasks.any {
+        it.name.endsWith("PublicationToMavenCentralRepository")
+    }
+}
 
 androidLibrary.publishing {
     singleVariant("vulkanRelease")
@@ -29,6 +37,10 @@ afterEvaluate {
         publishToMavenCentral(true)
         signAllPublications()
     }
+    // signAllPublications() creates the signatures used by the formal Central path. Override
+    // only its execution requirement: Local publish Sign tasks are skipped without a signatory,
+    // while every *PublicationToMavenCentralRepository task remains signing-required.
+    extensions.getByType<SigningExtension>().setRequired(signingRequiredForMavenCentral)
 }
 
 // Configure task dependencies after all tasks are created