fix(workflow): isolate verify and publish

[noctuum]

verify handled hostile content as root beside the Docker socket, and publish ran the strategies with the AUR key, the GPG key and the write token in place.

• check-all.sh --publish publishes the version in the status of the check job and runs no strategy, and the Publish updates step gets no GITHUB_TOKEN. A prepared pkgver other than that version fails with exit code 1 instead of a silent deferral.
• verify-pkg.sh and publish-pkg.sh clone the AUR repo with --no-checkout and read its files through git ls-tree and git cat-file. publish builds the index from HEAD and adds only the two prepared files.
• verify runs as builder and hands over with the same step as prepare.

bats tests/ --recursive: 419 pass, actionlint is clean.

[codecov]

Codecov Report

❌ Patch coverage is 97.05882% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
scripts/publish-pkg.sh	90.90%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!