Fix check-deploy-branch failure by removing fragile heredoc Python invocation

[Copilot]

check-deploy-branch was failing in GitHub Actions because the inline Python heredoc terminator was not parsed correctly in the YAML-indented shell block, causing an EOF syntax error. This prevented branch policy evaluation from completing and blocked deploy gating.

• Root cause

  • Reproduced failure mode from logs: Bash could not find the PY heredoc terminator in the run: | script context.

• Change made

  • Replaced the heredoc form (python - <<'PY' ... PY) with a single-argument inline script (python -c '...') in .github/workflows/publish.yaml.
  • Preserved branch-policy matching behavior (fnmatch against branch_policies[].name) and existing should_deploy output paths.

• Why this resolves it

  • Eliminates heredoc delimiter parsing sensitivity in YAML-indented shell blocks while keeping the same policy evaluation logic.

# before
if POLICY_RESPONSE="${policy_response}" BRANCH_NAME="${GITHUB_REF_NAME}" python - <<'PY'
  ...
PY

# after
if POLICY_RESPONSE="${policy_response}" BRANCH_NAME="${GITHUB_REF_NAME}" python -c '
...
'