Run build & twine upload in afterPublish instead of afterRelease

[yarikoptic-gitmate]

A one-line .autorc change to work around intuit/auto#1294 (spawnSync /bin/sh E2BIG from the exec plugin).

Why

• auto's exec plugin puts every hook argument into the environment as JSON in ARG_<n>.
• afterRelease's argument holds:
  • all commits in the release, with a full GitHub user record for every PR commit (about 1.4 KB each, not de-duplicated);
  • their changed files;
  • the release notes;
  • the full response from creating the GitHub release.
• Linux rejects any single environment string over 128 KiB (MAX_ARG_STRLEN), however much of the 2 MiB total (ARG_MAX) is left. So once a release has roughly 90 or more PR commits, execSync fails before python -m build && twine upload dist/* even starts, although that command never reads ARG_0.

What changes

• afterPublish takes no arguments, so no ARG_* variables are set and this failure can't happen.
• In auto shipit it runs right after publish: protected-branch has pushed its release branch and git-tag has pushed the new tag. The version the build derives from the tag is therefore the same as before.
• Only the order changes: PyPI upload now happens before the GitHub release is created and before released posts its comments. So if twine fails, no GitHub release is made for an unpublished version.
• One side effect: in that failure case, protected-branch's afterRelease cleanup of its temporary release branch doesn't run. That branch would need deleting by hand.

How to test

• This PR carries no release label, so merging it doesn't release anything.
• master currently has an unreleased minor change (Remove deprecated validate-bids command #1943). The next release, whether from a PR labelled release or a manual workflow_dispatch of "Auto-release on PR merge", becomes 0.81.0 and exercises this change.
• In the -vv log, expect: tag pushed → "Calling after publish hook" → build/twine output → GitHub release created.

An upstream fix for auto (oversized args go to a temp file exposed as ARG_<n>_FILE) is proposed in yarikoptic/intuit-auto#1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W872omgTVzywQbbjRvCX6q

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.33%. Comparing base (540c7c0) to head (d04b352).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1945      +/-   ##
==========================================
- Coverage   78.34%   78.33%   -0.01%     
==========================================
  Files          92       92              
  Lines       14109    14109              
==========================================
- Hits        11053    11052       -1     
- Misses       3056     3057       +1     

Flag	Coverage Δ
unittests	78.33% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[yarikoptic-gitmate]

CI note: two red checks on d04b352, neither caused by this PR (it changes only .autorc, which no test or packaged code reads).

• test (ubuntu-latest, 3.14, dev-deps): the pytest step died with exit code 139 (segfault) about 17 minutes in. It didn't fail an assertion. This job installs pynwb, hdmf, hdmf-zarr, nwbinspector and keyring from their git master branches. The same job passed on master at 06:08 UTC today (540c7c0), and every other matrix entry here passed, including ubuntu 3.14 normal and ubuntu 3.12 dev-deps. So this is either a flaky crash or a change on one of those dev branches since this morning. I couldn't retrieve the crashing test id: the log API only returns the last 5000 lines, which are the docker-compose dump. I'm re-running the failed job once to tell the two cases apart. No fix exists yet.
• codecov/project: 78.26% (−0.08%). The coverage delta comes from test-run variance; the diff has no Python lines to cover. codecov/patch passes.
• The early red check_labels run started before the internal label was added. The run triggered by the label passed.

---

Generated by Claude Code

[yarikoptic]

We should try! first I will merge this with release to see that all still works as expected! then idelly we aggregate lots of changes to test if it actually addresses the issue for us! ;-)

[github-actions]

🚀 PR was released in 0.81.0 🚀