publish.yml Craft state isolation

Chose $GITHUB_WORKSPACE/.craft-state with explicit XDG_STATE_HOME over state inside the target checkout because untrusted repository contents could pre-populate privileged Craft state. Derive collision-resistant state filenames from canonical publish identity, and set CRAFT_PUBLISH_STATE_GITHUB_REPO from the issue checkout repository—not an optional workspace release-repository override—so restoration and publication use the same identity.