Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/npm-publish.yml:
- Around line 418-423: The current loop captures the exit code after the entire
if compound so `$?` yields the `if` result rather than the `npm publish` exit
code; update the loop around the `if npm publish --tag ${{
steps.publish-tag.outputs.tag }} --access public; then` block to move the
publish-status capture into an `else` branch so that `publish_status` is set to
the immediate `$?` of the failed `npm publish` command (keep using the existing
`publish_status` variable and the same tag reference
`steps.publish-tag.outputs.tag`) and only break/set `publish_status=0` inside
the `then` branch when publish succeeds.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/npm-publish.yml:
- Around line 488-494: The summary appends "aiox-core legacy wrapper" whenever
the dependent job finished successfully, even if it skipped publishing; update
the condition to only append when the publish actually occurred by checking the
publish job's output (e.g. needs.publish_legacy_aiox_core.outputs.should_publish
== 'true' or a similar output flag) instead of just
needs.publish_legacy_aiox_core.result; modify the block that references
PUBLISHED_PACKAGES and needs.publish_legacy_aiox_core.result so it uses the job
output that indicates a real publish before adding "aiox-core legacy wrapper" to
PUBLISHED_PACKAGES.