Normalize publish-api-clients pins across the three service repos

[ExtraToast]

What to build

All three publishing service repositories reference one pinned version of the shared publish workflow.

They are currently skewed: two release pipelines reference a newer pinned revision while the third, and all three pull-request dry runs, reference an older tag. That means a change to the publisher reaches different services at different times, and a dry run can pass against generator behaviour that the release path no longer has.

Acceptance criteria

• Every reference to the shared publish workflow across the three service repositories resolves to the same revision
• Pull-request dry runs and release publishes use the same revision as each other
• Each repository's contract job still passes after the bump

Blocked by

• Add a workflow_dispatch republish path for API clients