[patch] Forward package publish lock settings

[pennypacker-he]

Summary

• forward all package publication lock controls into the publisher container
• add a regression test proving workflow-supplied lock timeouts reach the publisher
• include the Makefile contract in package-lock CI path filters

Validation

• bash scripts/test-make-lock-env.sh
• bash scripts/test-publish-lock.sh
• bash scripts/test-publish-cache-control.sh
• bash -n scripts/test-make-lock-env.sh