fix(actions): invoke publish.sh via bash, not direct exec

[jan-kubica]

Symptom

`stella/stdnum#95`'s release dispatch against `v0.0.1` exited 1 with no output and a script runtime of ~200ms. The composite step's env block was emitted to the log, then immediately `##[error]Process completed with exit code 1`. No `::error::` annotation, no `npm view` call, no `set -x` trace, nothing.

That pattern fits "bash failed to exec the script" — `set -e` exits on a failed exec without producing the script's own output.

Root cause

`publish.sh` is committed with git tree mode `100755` (verified). But the runner-side checkout of a composite action does not reliably preserve the executable bit. The action ADR documents this explicitly:

"you'll have to use `chmod` before running each script if you do not git check in your script files into your github repo with the executable bit turned on."
— actions/runner ADR 0549-composite-run-steps

And the community has hit it repeatedly even when the mode IS committed: community/discussions/26239.

Fix

Two documented patterns are correct:

1. `chmod +x` step + direct exec. Official tutorial pattern. Two steps; still mode-dependent at exec time (relies on the chmod actually sticking).
2. `bash `. Bash reads the file regardless of mode. One step; eliminates the failure mode entirely instead of relying on mode preservation.

This PR uses option 2.

```yaml
run: bash "${{ github.action_path }}/publish.sh"
```

Test plan

• research: official docs + runner ADR + community discussions all confirm the failure mode and both fixes
• shellcheck clean
• post-merge: bump SHA pin in stella/stdnum's release.yml, re-dispatch against `v0.0.1`. The composite should reach the `already_published` early-return and exit 0 without attempting to re-publish.

References

• actions/runner ADR 0549 — Composite Run Steps
• Creating a composite action — GitHub Docs
• community/discussions/26239 — "Action showing permission denied"

[gemini-code-assist]

Code Review

This pull request updates the npm-publish-hardened action to invoke the publish.sh script explicitly using bash, which prevents potential execution permission issues in the GitHub Actions runner. A review comment suggests adding the -e flag to the bash command to ensure the script fails immediately on errors, as the shebang line is ignored during explicit invocation.

[gemini-code-assist]

When a script is invoked explicitly via bash <path>, the shebang line (e.g., #!/bin/bash -e) is ignored by the shell. To ensure the action fails immediately if any command within publish.sh fails, it is recommended to explicitly pass the -e flag to the bash command. This is especially important for a "hardened" action to prevent silent failures during the publish process.

      run: bash -e "${{ github.action_path }}/publish.sh"

[jan-kubica]

CC on behalf of @jan-kubica

Applied in latest commit. Worth noting that publish.sh's second line is `set -euo pipefail`, so the safety settings are already in effect from the script's perspective — only line 1 (the shebang comment) runs without them, and that's a no-op. But passing the flags to the sub-bash is correct defense-in-depth and aligns with the GitHub Actions runner's own default shell config (`bash --noprofile --norc -e -o pipefail {0}`).