feat!: run on push and checkout release PR head commit

[sparten11740]

This refactors the publish action to be able to run on push in the context of the base branch. It identifies the commit's corresponding pull request to checkout its head commit. Most of our repositories are configured to delete PR branches after merging, which stops us from checking out the head SHA directly.

We need to filter a bit different to avoid running to often (e.g. on push to irrelevant PR branches). The following worked well in the test repo:

if: github.event_name == 'workflow_dispatch' || (contains(github.event.head_commit.message, format('chore{0} release', ':')) && ! startsWith(github.ref, 'refs/tags/'))

Test Plan

Successful run in https://github.com/ExodusMovement/actions-playground/actions/runs/20093513534/job/57646239041

[mvayngrib]

non-blocking: they don't provide an error code or something?

[sparten11740]

there might be one, checking

[sparten11740]

unfortunately no, this is the whole body they return:

{
    "message": "Reference already exists",
    "documentation_url": "https://docs.github.com/rest/git/refs#create-a-reference",
    "status": "422"
}