The publish_cli job was checking out the default ref instead of the
preflight commit, so it published with the pre-bump version. Add the
correct ref to checkout and a --app-version flag as a safety override.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>