fix(boxel-cli): consolidate publish workflows, push annotated tags

[FadhlanR]

Summary

Run 26077192437 failed for two independent reasons, both fixed here:

1. OIDC trusted-publisher mismatch — boxel-cli-on-main.yml requested an OIDC token whose job_workflow_ref claim didn't match the npm trusted-publisher rule (registered for manual-boxel-cli-publish.yml). pnpm fell back to NODE_AUTH_TOKEN, which is empty because the package migrated to trusted publishing — npm returned 404 on the unauthenticated PUT.
2. Lightweight tag never pushed — git tag "\$TAG" creates a lightweight tag; git push --follow-tags only pushes annotated tags. The tag stayed on the runner, and gh release create then failed with tag exists locally but has not been pushed.

This PR consolidates both publish flows into a single .github/workflows/boxel-cli-publish.yml with two jobs gated by github.event_name (so both share one trusted-publisher rule), and switches every git tag invocation to the annotated form git tag -a "\$TAG" -m "\$TAG".

Out-of-band action required

Before this PR's first post-merge run can publish, update the npm trusted-publisher rule:

1. npmjs.com → @cardstack/boxel-cli → Settings → Trusted Publishers
2. Edit the existing rule: change workflow filename from manual-boxel-cli-publish.yml to boxel-cli-publish.yml. Repo and environment fields unchanged.

The PR itself is safe to land before the rule is updated — the workflow only fires on merges to main, not PR pushes.

Recovery for the orphan 0.2.0-unstable.294

That version is on npm but has no git tag on origin and no GitHub Release. Recommended: skip — the next merge will produce 0.2.0-unstable.295 with a proper annotated tag and Release.

Test plan

• yamllint passes locally on boxel-cli-publish.yml and boxel-cli-pr-title.yml (confirmed before commit).
• After landing + npm rule update: merge any chore(boxel-cli): PR to main → workflow loads under new filename, compute-release short-circuits at npmBump=none, no publish attempted.
• Next real fix(boxel-cli): or feat(boxel-cli): merge: push log shows both main -> main AND * [new tag] boxel-cli-v0.2.0-unstable.NNN -> boxel-cli-v0.2.0-unstable.NNN. OIDC token-exchange returns 200 (no "Skipped OIDC" warning). GitHub Release created with rich notes body. CHANGELOG.md updated.
• First stable promotion via workflow_dispatch with confirm: promote: same OIDC success path, dist-tag latest, annotated stable tag pushed.

🤖 Generated with Claude Code