Address publish workflow review feedback

[jozefizso]

Summary

• skip npm publishing for GitHub prereleases so prerelease releases cannot publish the default latest dist-tag
• check whether the exact package version already exists on npm
• skip pack, attestation, artifact upload, and publish steps when the version is already published so workflow reruns are safe

Verification

• YAML parse for publish workflow