👷 Publish the dist built by the build job

The publish job re-ran npm ci + build from scratch, discarding the
output that check, test:ci and publint had already gated, and paying
the build twice on a tag push. Upload dist/ as an artifact from build
and download it in publish instead. npm ci stays for the publint/attw
binaries; only the redundant rebuild is gone.

.gitea/workflows/ci.yml

@@ -25,6 +25,13 @@ jobs:
             # enough to run on every push so a packaging break fails here, not
             # at release time.
             - run: npm run publish:publint
+            # Persist the exact dist/ that `check`, `test:ci` and `publint` were
+            # run against, so `publish` ships those bytes instead of rebuilding
+            # (which could in principle differ and would pay the build twice).
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
 
     # Advisory scans (dead code, dependency freshness). Non-blocking: surfaced in
     # the Actions tab for visibility, but must never gate a merge — so
@@ -61,7 +68,12 @@ jobs:
                   node-version-file: .node-version
                   registry-url: "https://registry.npmjs.org/"
             - run: npm ci
-            - run: npm run build
+            # Consume the dist/ that `build` produced and gated, instead of
+            # rebuilding here — `publish` must ship the tested artifact.
+            - uses: actions/download-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
             - run: npm run publish:publint
             - run: npm run publish:attw
             - run: npm publish --access public