- publish.yml: main package only, triggers platform workflow on success - publish-platform.yml: dedicated workflow with fresh OIDC token per run - Fixes OIDC token expiration during large binary uploads (~40MB+) - Platform workflow can also be triggered manually via workflow_dispatch