[codex] Fix publish build source tracking

[Prasanna721]

What changed

• Keep lib/validate.ts ignored and explicitly excluded from Biome.
• Change build:lib to verify the committed lib/validate.js and lib/validate.d.ts artifacts instead of rebuilding from ignored source.
• Run the full package build in the publish workflow and allow publish to be triggered manually or by lib/workflow changes.

Root cause

The publish workflow was running bun run build:lib, and that script tried to compile lib/validate.ts. That file is intentionally ignored, so a clean GitHub checkout did not contain it and esbuild failed with Could not resolve lib/validate.ts.

Validation

• bun run build:lib
• npm run build
• bun run check-types
• bun run lint
• Repeated the same checks from a clean temporary worktree without lib/validate.ts.