👷 Publish the dist built by the build job

The publish job re-ran npm ci + build from scratch, discarding the
output that check, test:ci and publint had already gated, and paying
the build twice on a tag push. Upload dist/ as an artifact from build
and download it in publish instead. npm ci stays for the publint/attw
binaries; only the redundant rebuild is gone.

backlog.tasks

@@ -31,10 +31,10 @@ Setup:
 ✔ Run packaging checks in CI `build` @done
     - `publish:publint` / `publish:attw` only run in the tag-triggered `publish` job, so a PR that breaks packaging stays green until release
     ✔ At minimum add `publish:publint` to the `build` job (offline, fast); `attw` needs a pack @done
-☐ Publish the exact artifact CI tested
+✔ Publish the exact artifact CI tested @done
     - `publish: needs: build`, then re-runs `npm ci` + `build` from scratch, discarding the tested output
     - tag push pays a double build and the two builds could differ
-    ☐ Persist `dist/` as an artifact in `build` and consume it in `publish`
+    ✔ Persist `dist/` as an artifact in `build` and consume it in `publish` @done
 ☐ Confirm pre-push gate strength
     - pre-push runs `npm test` (`check:tsc` + tests), not full `check`; oxlint/oxfmt/cspell drift on unstaged content is only caught per-staged-file at commit or whole-project in CI
     ☐ Confirm this is intended per the feedback-tier table, or point pre-push at `verify`