fix(ci): create git tags and GitHub releases for JS package publishes (#15732)

`ci:publish` used `pnpm publish -r`, but changesets/action discovers what
was published from the newline-delimited JSON the publish script writes to
`$CHANGESETS_OUTPUT`, reading the `git-tag` events out of it. `pnpm publish`
never writes that file, so the released-package list was always empty, the
`create-github-releases` loop iterated zero times, and the action reported
`published: false`.

The npm publishes themselves have always succeeded — but no JS package has
ever been tagged or given a GitHub release. `git for-each-ref refs/tags`
contains zero `@arizeai/*` tags; every tag in the repo comes from
release-please.

Switch `ci:publish` to `changeset publish`, which emits those events and
tags each published package. Two changes come with it:

- `access` in the changesets config was `restricted`, unused because the
  old script passed `--access public` explicitly. `changeset publish` does
  honor it, so it has to become `public`.
- `changeset publish` builds its own publish flags and never passes
  `--provenance`, so request provenance through npm config instead. The
  workflow already grants `id-token: write`.

Note this does not backfill: the 6 packages' current versions stay
untagged, and tagging starts from the next release.