ci: gate toolstate repo pushes on the TOOLSTATE_PUBLISH envvar

Unfortunately due to an Azure quirk the TOOLSTATE_REPO_ACCESS_TOKEN is
not suitable to gate whether to push new commits to the repo, as if it's
not defined on the Azure side it will actually be set to the literal
`$(TOOLSTATE_REPO_ACCESS_TOKEN)`, which screws everything up.

This instead adds another, non-secret environment variable to gate
publishing: TOOLSTATE_PUBLISH. As non-secret environment variables
behave correctly this fixes the issue.

src/ci/docker/x86_64-gnu-tools/checktools.sh

@@ -112,7 +112,7 @@ $COMMIT\t$(cat "$TOOLSTATE_FILE")
 }
 
 if [ "$RUST_RELEASE_CHANNEL" = nightly ]; then
-    if [ -n "${TOOLSTATE_REPO_ACCESS_TOKEN+is_set}" ]; then
+    if [ -n "${TOOLSTATE_PUBLISH+is_set}" ]; then
         . "$(dirname $0)/repo.sh"
         MESSAGE_FILE=$(mktemp -t msg.XXXXXX)
         echo "($OS CI update)" > "$MESSAGE_FILE"