Use shared workflow for JS+PY release

[David Elner (delner)]

Replaces the separate publish-js.yaml / publish-py.yaml workflows and their dispatcher with a single publish.yaml that releases the npm and PyPI autoevals packages together, at one shared version, behind one approval gate . The workflow is built on the shared release actions from braintrustdata/sdk-actions.

What changes

• One workflow, two lanes (js + py): configure → prepare → validate → pack per lane, one shared request-approval, then a gated ship-package per lane.
• Release actions perform attestation, SBOM and gating.

Benefits

• One approval, both packages. A single reviewer approval releases npm and PyPI; if either lane
  fails before the gate, neither ships.
• Supply-chain hardening. An unprivileged job builds + generates a CycloneDX SBOM + attests (no publish creds); a gated job verifies the attestation and publishes those exact bytes via OIDC trusted publishing, npm provenance + PyPI PEP 740, no tokens.
• Less bespoke YAML. Release logic lives in versioned, SHA-pinned shared actions; upstream improvements arrive with a SHA bump instead of hand-edits.

[github-actions]

Braintrust eval report

Autoevals (HEAD-1784174182)

Score	Average	Improvements	Regressions
NumericDiff	78.6% (+0pp)	9 🟢	10 🔴
Time_to_first_token	9.04tok (+0.5tok)	84 🟢	135 🔴
Llm_calls	1.55 (+0)	-	-
Tool_calls	0 (+0)	-	-
Errors	0 (+0)	-	-
Llm_errors	0 (+0)	-	-
Tool_errors	0 (+0)	-	-
Prompt_tokens	528.42tok (+0tok)	-	-
Prompt_cached_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_5m_tokens	0tok (+0tok)	-	-
Prompt_cache_creation_1h_tokens	0tok (+0tok)	-	-
Completion_tokens	472.75tok (+3.88tok)	103 🟢	98 🔴
Completion_reasoning_tokens	362.18tok (+5.82tok)	87 🟢	81 🔴
Completion_accepted_prediction_tokens	0tok (+0tok)	-	-
Completion_rejected_prediction_tokens	0tok (+0tok)	-	-
Completion_audio_tokens	0tok (+0tok)	-	-
Total_tokens	1001.18tok (+3.88tok)	103 🟢	98 🔴
Estimated_cost	0$ (+0$)	90 🟢	87 🔴
Duration	9.04s (+0.5s)	84 🟢	135 🔴
Llm_duration	9.76s (+0.47s)	88 🟢	131 🔴