publish-npm workflow might checkout a different commit other than the one that triggered the publish

[caugner]

Rari:

• https://github.com/mdn/rari/blob/ed28ccac0895124be9b7317fde6dbece23d2bc0b/.github/workflows/publish-npm.yml#L3-L6
• https://github.com/mdn/rari/blob/ed28ccac0895124be9b7317fde6dbece23d2bc0b/.github/workflows/publish-npm.yml#L16-L19

Watify:

• https://github.com/mdn/watify/blob/800455e3a35d5c635baa2da4ffc1a5a46288f3d7/.github/workflows/publish-npm.yml#L3-L6
• https://github.com/mdn/watify/blob/800455e3a35d5c635baa2da4ffc1a5a46288f3d7/.github/workflows/publish-npm.yml#L16-L19