chore(ci): publish from the release run instead of a release-branch push

[jfrench9]

Summary

• publish.yml is gone. Its job now runs inside create-release.yml after create-tag, under the production environment, so the required-reviewer prompt lands on the run just dispatched instead of on a second workflow.
• The job checks out the release tag and verifies the version matches the one the run cut before anything is published.
• A failed publish is retried with Re-run failed jobs on that run; the version and tag are already cut. A new release is only needed when the code itself is at fault.
• The regenerate dispatch input goes with publish.yml. A package regenerated at publish time would not match the tag it is signed against; regeneration belongs in a PR.
• The /publish, /create-pr, /staged-review and /release-notes command docs describe the new flow.

Before the next release

npm's trusted publisher for @robosystems/client must list create-release.yml with environment production. npm validates the calling workflow's filename, which is why the job is embedded rather than called from a reusable workflow. The publish.yml entry can be removed once a release has gone through.

🤖 Generated with Claude Code