While this moves the source of truth for CI tooling versions to somewhere outside the workflow definitions, it also avoids duplication and keeps debug (check.yaml) and production (publish.yaml) verifications fully independent.
