Craft publish state never reads repo-local files

Craft never reads repository-local publish state. Chose workflow-provided XDG state paths over deriving .craft-publish-<version>.json in the checkout because checkout contents are attacker-controlled and duplicate state-key logic drifts from Craft. The publish workflow computes the canonical state path, passes it as CRAFT_STATE_FILE_PATH for issue recovery, and Craft uses CRAFT_PUBLISH_STATE_GITHUB_REPO only to identify its secure state filename.