Fix main publish runtime dependency ordering

[khaliqgant]

Summary

• publish the root CLI's exact-version @agent-relay/* runtime dependencies for package=main and package=cli-prerelease before publishing agent-relay
• run the SDK broker/internal dependency chain for main-only CLI publishes, since the root package depends on @agent-relay/sdk
• make package publishes idempotent by skipping versions that already exist, and wait for root internal deps before publishing/skipping the root tarball

Verification

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/publish.yml'); puts 'YAML OK'"
• actionlint -shellcheck= .github/workflows/publish.yml
• git diff --check
• verified npm registry is missing @agent-relay/cloud@6.0.5 and the other root internal deps except config, matching the reported install failure

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c2ca17dd0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate release job when root package publish is skipped

This new early-exit makes publish-main succeed whenever agent-relay@<version> already exists, but create-release still runs because it only checks needs.publish-main.result == 'success'. In a rerun or repair invocation that reuses an already released custom_version, this path reaches the later tag creation/push steps and fails on the existing tag, so the workflow is no longer idempotent for the exact scenario this change is trying to support.

Useful? React with 👍 / 👎.

[khaliqgant]

Addressed in e578da0. publish-main now exposes a published output from the root publish step: already-existing agent-relay@<version> sets published=false, successful npm publish sets published=true, and create-release now requires needs.publish-main.outputs.published == 'true'. Repair reruns can publish missing deps and skip the existing root package without trying to recreate the tag/release.