refactor(ci): retrofit onto parity-lib mkAtticClosurePublish (#200)

Replace the bespoke ci/publish.py attic-push logic with parity-lib's
mkAtticClosurePublish builder (attic-closure archetype, cluster#104,
emmett#44). Adds the parity input (locked at d265a79) and wires the
per-arch package closures through builders.mkAtticClosurePublish, with
the endpoint (nix-cache-upload.oleks.space) and passEntry
(infra/attic/ci_token) overridden so the attic push is byte-for-byte the
pre-parity behaviour.

.woodpecker/{amd64,arm64}.yaml thinned to PUBLISH=1 nix run .#publish /
.#publish-aarch64-linux so CI and a local run share one audited impl.
Dead ci/publish.py + ci/build.py removed.

pipeline-doctor: 9 passed / 0 failed / 0 warned.

.woodpecker/amd64.yaml

@@ -37,6 +37,8 @@ steps:
     commands:
       - echo "▸ arch=$(uname -m)"
       - sh ci/setup.sh
-      # Same entrypoint as a local `nix run .#publish-amd64 -- --push`.
-      # PUBLISH=1 makes the shared script actually push (local runs dry-run).
-      - PUBLISH=1 python3 ci/publish.py x86_64-linux
+      # Same front door as a local `nix run .#publish -- --publish`. The app
+      # is parity-lib's mkAtticClosurePublish (attic-closure archetype); CI and
+      # local share one audited impl. PUBLISH=1 makes it actually push (local
+      # runs dry-run).
+      - PUBLISH=1 nix run .#publish

.woodpecker/arm64.yaml

@@ -37,6 +37,6 @@ steps:
       - sh ci/setup.sh
       # NODE-BOUND LEG (emmett#44, cluster#192): aarch64-linux can't be built on
       # emmett (linux/amd64) and these native packages have no cross path, so this
-      # leg has no local-parity flake app — it must run on an aarch64 node (the
-      # arch nodeSelector above). Same shared entrypoint as amd64, only arch differs.
-      - PUBLISH=1 python3 ci/publish.py aarch64-linux
+      # leg must run on an aarch64 node (the arch nodeSelector above). Same
+      # parity-lib attic-closure front door as amd64, only the arch app differs.
+      - PUBLISH=1 nix run .#publish-aarch64-linux