ci: soft-skip on missing secrets and add curl timeouts (CodeRabbit)

Author: luke-mino-altherr

.github/workflows/notify-on-merge.yml

@@ -18,12 +18,12 @@ jobs:
         run: |
           set -euo pipefail
           if [ -z "${DISPATCH_TOKEN:-}" ] || [ -z "${TARGET_REPO:-}" ]; then
-            echo "::error::SYNC_DISPATCH_TOKEN and SYNC_TARGET_REPO are required."
-            exit 1
+            echo "::notice::SYNC_DISPATCH_TOKEN/SYNC_TARGET_REPO not set; skipping downstream notify."
+            exit 0
           fi
           PAYLOAD="$(jq -n --arg sha "$COMMIT_SHA" \
             '{ event_type: "upstream-push", client_payload: { sha: $sha } }')"
-          curl -fsSL -X POST \
+          curl -fsSL --connect-timeout 10 --max-time 60 -X POST \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
             "https://api.github.com/repos/${TARGET_REPO}/dispatches" \