Address publish workflow review feedback

[jozefizso]

Summary

• skip npm publishing for GitHub prereleases so prerelease releases cannot publish the default latest dist-tag
• check whether @appdmg/appdmg and @appdmg/cli exact versions already exist on npm
• skip pack, attestation, artifact upload, and publish steps per package when already published, allowing reruns after partial publish failures
• document prerelease and rerun behavior

Verification

• YAML parse for publish workflow