[Feature]: Re-enable publishing dev packages on PR merge

[JoeCap08055]

What happened?

Since the transition to GitHub OAuth for publishing to npm, the workflow that is triggered on merging a PR to main that was supposed to publish commit-hash-tagged npm packages for that PR was not updated and was failing.

In the interest of developer time and a green pipeline, we've since removed the publishing of dev packages from the pipeline, but it would be nice to add it back in once there's bandwidth to address the creation of a shared workflow for publishing.

Relevant log output

https://github.com/frequency-chain/frequency/actions/runs/20728882400/job/59511449792

[JoeCap08055]

So, from my research I believe I've determined the following:

• Our current pattern of reusable actions cannot be used to refactor npm publishing, because npm Trusted Publishing can only reference a workflow, not an action.
• However, we can define a reusable workflow that's triggered vi on: workflow_call

Whereas reusable actions represent a single step that can be invoked as a step in a job, reusable workflows are themselves jobs that consist of multiple steps. A reusable workflow has its own runner and does not share state or filesystem artifiacts with the calling job (though you can pass string inputs using with: <input>.

So I think the approach would be:

• Have the main workflow build & upload artifacts, and pass the appropriate details (artifact names, versions to publish) to a shared workflow
• The shared workflow has the OIDC creds, downloads the artifact(s) and publishes the packages