ci: run release + CLI publish jobs on ubuntu-latest (#1291)

The Blacksmith runner migration (#1286) broke npm trusted publishing:
Blacksmith runners mint OIDC tokens from a different issuer than GitHub
Actions, so npm rejects the provenance publish with a 404. Move only the
two publish jobs back to GitHub-hosted runners so the OIDC issuer matches
the configured trusted publishers; the rest of the Blacksmith migration
is unaffected.

Author: RhysSullivan

.github/workflows/publish-executor-package.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     permissions:
       actions: write
       contents: write

.github/workflows/release.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     permissions:
       actions: write
       contents: write