Craft publishState.ts: filename missing workspace key causes cross-workspace collision

Trap: keying publish-resume state by sanitized version looks stable because filenames need safe characters, but distinct valid SemVer build metadata such as 4.2.6+sentry1 and 4.2.6+Sentry1 collapse to one state file and silently skip targets. Fix: preserve legacy filenames for versions unchanged by sanitization; when sanitization changes a version, use a lossless Base64URL version component. Apply the identical rule in Craft publishState.ts and Publish Set targets; retain lossless Base64URL workspace isolation and never read repository-local state.