publish:publint and publish:attw only ran in the tag-triggered publish job, so a packaging break stayed green until release. Add publint to build (offline, fast, packs the built dist). attw stays in publish, where the full resolution matrix is worth the cost.