Require passing checks on main and before publishing

[CatarinaGamboa]

Why: checks only protect main if a PR can't merge while they fail, and a release shouldn't publish a build that fails its tests.

What:

• Branch protection (or a ruleset) on main that requires the test.yml jobs to pass.
• Make publish.yml run the tests first. For example, turn test.yml into a reusable workflow (workflow_call) and add needs: to the publish job.

References:

• GitHub docs, required status checks: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging
• vscode-java's release workflow runs the tests (xvfb-run ... npm run test) in its packaging job, and publishing needs: that job: https://github.com/redhat-developer/vscode-java/blob/main/.github/workflows/release.yml