ci: separate standalone publishing from dependent publishing

[Brendonovich]

Now that the publish workflow keeps its release as a draft until the workflow completes, it's possible for a published package (eg brew, AUR) to reference a release that is currently drafted. To remedy, I've split up some of the publish process.

At a high level, the first job runs publish-start.ts, which publishes to npm, ghcr, and creates the draft release. Next the desktop builds run, downloading the previously published CLI binaries from the draft release, and uploading their own assets to the release. Lastly in publish-complete.ts the release is un-drafted, then the brew and AUR packages are published (since now the assets they reference are published).

The naming here and organisation of the scripts probably needs changing.