publish.yml canonical cwd state hash

Trap: hashing the textual publish path appears equivalent to Craft’s cwd hash, but packages/../cli and cli name the same directory with different bytes. Fix: publish.yml canonicalizes /github/workspace/__repo__/$CRAFT_PUBLISH_PATH with realpath -m, rejects paths outside the repository root, then SHA-1 hashes that canonical cwd exactly as Craft hashes process.cwd(). Test the actual workflow Set targets shell with root and workspace fixtures; unit-testing a reimplementation misses drift in title repository parsing, cwd hashing, Base64URL workspace encoding, and emitted state payload. Compare parsed JSON rather than literal formatting, because pretty-printing is not state semantics.