Refactor: deduplicate triplicated publish orchestration (~550 lines)

[0xLeif]

The publish flow is copy-pasted across template/plugin/lane publish (~550 near-identical lines) with concrete drift — e.g. plugin and lane publishes create commits titled "Publish fledge template". The git-token→Basic-auth http.extraheader injection is likewise triplicated with stderr-handling drift (the publish.rs path was just hardened in #441 to redact + read stderr; the plugin/lane copies should get the same). Extract a shared push_directory/publish helper so the three paths can't drift.

Files: src/publish.rs, plugin publish, lane publish.

---

Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.

[0xLeif]

This is done. `plugin/publish.rs` and `lanes/publish.rs` both delegate to the shared `crate::publish::run_publish`/`push_directory` in `src/publish.rs` — no more triplicated push/token-injection logic, and the commit-message drift is gone since all three paths go through the same orchestration.

Closing.