ci(publish): publish kustomize bundle only after the image build

The publish-kustomize-bundles job pins its image references to the build's tag,
but ran in parallel with publish-container-image — so the bundle could be
published before (or without) the image it points at. Add a needs dependency so
the bundle is only published once the container image has been built and pushed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scotwells

.github/workflows/publish.yaml

@@ -23,6 +23,9 @@ jobs:
     secrets: inherit
 
   publish-kustomize-bundles:
+    # The bundle pins image references to this build, so only publish it once
+    # the container image has been built and pushed.
+    needs: publish-container-image
     permissions:
       id-token: write
       contents: read