Use shared workflow for JS+PY release

[David Elner (delner)]

Replaces the separate publish-js.yaml / publish-py.yaml workflows and their dispatcher with a single publish.yaml that releases the npm and PyPI autoevals packages together, at one shared version, behind one approval gate . The workflow is built on the shared release actions from braintrustdata/sdk-actions.

What changes

• One workflow, two lanes (js + py): configure → validate → pack per lane, one shared request-approval, then a gated ship-package per lane.
• Release actions perform attestation, SBOM and gating.

Benefits

• One approval, both packages. A single reviewer approval releases npm and PyPI; if either lane
  fails before the gate, neither ships.
• Supply-chain hardening. An unprivileged job builds + generates a CycloneDX SBOM + attests (no publish creds); a gated job verifies the attestation and publishes those exact bytes via OIDC trusted publishing, npm provenance + PyPI PEP 740, no tokens.
• Less bespoke YAML. Release logic lives in versioned, SHA-pinned shared actions; upstream improvements arrive with a SHA bump instead of hand-edits.

[github-actions]

Braintrust eval report

Autoevals (HEAD-1784257511)

Score	Average	Improvements	Regressions
NumericDiff	79.4% (+2pp)	11 🟢	6 🔴
Time_to_first_token	8.16tok (-0.31tok)	122 🟢	95 🔴
Llm_calls	1.55 (+0)	-	-
Tool_calls	0 (+0)	-	-
Errors	0 (+0)	-	-
Llm_errors	0 (+0)	-	-
Tool_errors	0 (+0)	-	-
Prompt_tokens	528.42tok (+2.9tok)	-	2 🔴
Prompt_cached_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_5m_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_1h_tokens	0tok (+0tok)	-	-
Completion_tokens	465tok (-12.52tok)	103 🟢	98 🔴
Completion_reasoning_tokens	351.13tok (-16.29tok)	96 🟢	88 🔴
Completion_accepted_prediction_tokens	0tok (+0tok)	-	-
Completion_rejected_prediction_tokens	0tok (+0tok)	-	-
Completion_audio_tokens	0tok (+0tok)	-	-
Total_tokens	993.42tok (-9.62tok)	103 🟢	98 🔴
Estimated_cost	0$ (0$)	98 🟢	87 🔴
Duration	8.16s (-0.3s)	122 🟢	96 🔴
Llm_duration	9.01s (-0.24s)	121 🟢	96 🔴

[Abhijeet Prasad (AbhiPrasad)]

don't we still need two different files for trusted publishing? Or is it that both python and js point to the same file?