chore(ci): publish from the release run instead of a release-branch push

[jfrench9]

Summary

• publish.yml is gone. Its job now runs inside create-release.yml after create-tag, under the production environment, so the required-reviewer prompt lands on the run just dispatched instead of on a second workflow.
• The job checks out the release tag and verifies the version matches the one the run cut before anything is built or uploaded.
• A failed publish is retried with Re-run failed jobs on that run; the version and tag are already cut. A new release is only needed when the code itself is at fault.
• The /publish, /create-pr, /staged-review and /release-notes command docs describe the new flow.

Before the next release

PyPI's trusted publisher for robosystems-client must list create-release.yml with environment production. PyPI does not accept a reusable workflow as a trusted publisher, which is why the job is embedded rather than called. The publish.yml entry can be removed once a release has gone through.

🤖 Generated with Claude Code