getsentry/publish: label-based state machine for publish gating

getsentry/publish label state machine (post-PR #7881 + retry-race fix): accepted (human/auto-approve, added first), ci-pending (added by waiting-for-ci in publish.yml AFTER accepted), ci-ready (added by poller when CI passes), ci-failed (added by poller on failure, also removes accepted). Publish gate fires ONLY on ci-ready label event — not accepted — to prevent race where publish and waiting-for-ci run in parallel on the same labeled: accepted event when ci-ready is stale from a previous failed publish. waiting-for-ci job (on accepted labeled, when ci-pending or ci-failed present): removes ci-failed AND ci-ready (critical: stale ci-ready must be cleared so poller's re-add generates a fresh labeled event), adds ci-pending, comments, triggers poller. Concurrency group uses github.event.issue.title to lock on repo@version.