fix(release): publish with relative paths, and stop skipping the wheel build

[adhikjoshi]

v0.1.3 reached neither registry. GitHub release and Homebrew were fine. Two faults, both mine, both invisible to the way I tested.

1. publish.sh used node -p require('${dir}/package.json')

Node treats a path that doesn't begin with ./ or / as a module specifier, so require('dist/npm/@modelslab/cli-linux-x64/package.json') is a module lookup:

old (node -p require): Cannot find module
new (jq): @modelslab/cli-linux-x64

It worked in every local test because those passed absolute paths. CI passes a relative dist dir. Replaced with jq, which reads a file as a file.

2. The PyPI guard was on the wrong step

if: always() was on the upload alone. npm failed → the wheel build was skipped as an ordinary downstream skip → the upload then ran and died on Cannot find file dist/pypi/*.whl.

A guard on the last step of a chain protects nothing. Every PyPI step now carries it, as !cancelled() so a cancelled run still stops.

Guard against the class, not just the instance

CI now dry-runs publish.sh against a stubbed npm — from the repo root with a relative dist dir, the shape the release actually uses — and asserts seven packages with the unscoped entry published last. Both bugs above would have failed it.

Verified locally, with a relative path this time

publish @modelslab/cli-darwin-arm64@0.1.4
publish @modelslab/cli-darwin-x64@0.1.4
publish @modelslab/cli-linux-arm64@0.1.4
publish @modelslab/cli-linux-x64@0.1.4
publish @modelslab/cli-win32-arm64@0.1.4
publish @modelslab/cli-win32-x64@0.1.4
publish modelslab-cli@0.1.4 <- entry last
wheels ready for the PyPI step: 6

Needs a new tag (v0.1.4) — re-running v0.1.3 would execute the workflow file from that tag's commit, which still has both bugs.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}