feat(cli): add ferrflow publish to run publishers without releasing

[BryanFRD]

@

What

Adds a standalone ferrflow publish [PACKAGE] command that runs the configured publishers for each packages currently-released version — without bumping, committing, or tagging. Also exposes it through the GitHub Action as mode: publish.

Why

Publishers from #571 otherwise only run inside ferrflow releases job, which is often minimal (checkout + binary). Publishers that need a build toolchain or registry auth — docker buildx, helm, a built npm dist/ — cant run there. ferrflow publish lets a separate tag-triggered CI job, with buildx/helm/login already set up, run the publishers. This unblocks dogfooding the docker/helm/npm publishers (FerrVault operator, UI).

How it works

• Reads each packages current version from versionedFiles (or the latest matching tag for tag-only packages, schema: versionedFiles is optional in schema but required to release (tag-only packages skipped) #531), derives the tag, builds a PublishContext, and runs the publishers.
• Idempotent: anything already on the registry is skipped, so a re-run is safe. Honors global --dry-run.
• Extracts the publisher run/print loop into publishers::run_all, now shared by the release post-publish phase and the new command (no duplicated dispatch).

Verification

• 6 unit tests on the command (version resolution from files + tag fallback, unknown-package error, no-packages error, no-publishers no-op, dry-run dispatch) + 2 CLI parse tests. Full suite: 736 bin + 600 lib green, clippy clean.
• Ran locally against Kits config: ferrflow --dry-run publish reads all 10 crates versions and previews each cargo publisher.

Docs (CLI reference) ship in a FerrFlow-Cloud PR.

Closes #580
@

[github-actions]

Benchmark

Details

Benchmark suite	Current: 840dc68	Previous: 0b5fe57	Ratio
full_check_flow/100_commits	8376944 ns/iter (± 40750)
full_check_flow/1000_commits	80653517 ns/iter (± 376971)

This comment was automatically generated by workflow using github-action-benchmark.