fix(publish): pin action-gh-release to @v2 to bypass v3 CDN miss

GitHub Actions runners are persistently 404'ing on softprops/action-gh-release@v3
even though the SHA resolves correctly via api.github.com and codeload responds
200 from outside the runner edge. Pin to @v2.6.2 (released same day as v3.0.0,
identical API for our usage: tag_name, name, generate_release_notes,
target_commitish). The Trusted Publisher OIDC trust is keyed on filename + repo +
branch, not file contents — this change is safe.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MajorTal

.github/workflows/publish.yml

@@ -222,7 +222,7 @@ jobs:
 
       - name: Create GitHub release
         if: ${{ !inputs.dry_run }}
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ steps.bump.outputs.new }}
           name: 'v${{ steps.bump.outputs.new }}'