Run DotSlash publishing directly on Ubuntu runners (#45035)

## Why

Avoid rebuilding the upstream Docker image and downloading its apt dependencies for each release by using the Python and `gh` already available on Ubuntu runners.

## What changed

Add a shared composite action that checks out the pinned upstream publisher and uses pinned `uv` to install hash-verified Python dependencies from wheels in a virtual environment. Accept multiple configuration paths and publish each manifest for the requested tag.

Update the Rust and zsh release workflows to use the action, combining the Codex and argument-comment-lint manifests into one invocation.

GitOrigin-RevId: 2a7ffef9a076a1d426349bcea587b10599cb8175

.github/workflows/rust-release-zsh.yml

@@ -174,9 +174,9 @@ jobs:
           prerelease: true
 
       - name: Publish DotSlash manifest
-        uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+        uses: ./.github/actions/publish-dotslash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag: ${{ needs.metadata.outputs.release_tag }}
-          config: .github/dotslash-zsh-config.json
+          configs: .github/dotslash-zsh-config.json

.github/workflows/rust-release.yml

@@ -1724,19 +1724,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+      - uses: ./.github/actions/publish-dotslash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag: ${{ github.ref_name }}
-          config: .github/dotslash-config.json
-
-      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag: ${{ github.ref_name }}
-          config: .github/dotslash-argument-comment-lint-config.json
+          configs: |
+            .github/dotslash-config.json
+            .github/dotslash-argument-comment-lint-config.json
 
   # Publish to npm using OIDC authentication.
   # July 31, 2025: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/