Split publish into a separate reusable workflow (publish.yml) that can be triggered manually via workflow_dispatch or called from release- please. This allows re-running publish independently when a release already exists but publishing failed.