fix(build): publish from artefact path to include vendored deps

[jakehildreth]

Problem

When publishing via New-ConfigurationPublish inside the Build-Module {} scriptblock, PSPublishModule calls Publish-Module -Name Locksmith2 which resolves the module from $PSModulePath. That copy is written before the post-build vendoring step, so PSWriteHTML and PSCertutil are never included in what gets uploaded to PSGallery.

Solution

• Removed New-ConfigurationPublish from the Build-Module {} scriptblock entirely
• Extracted all post-build logic into Build/Invoke-LS2PostBuildPublish.ps1, a proper advanced function with SupportsShouldProcess and comment-based help
• Build-Module.ps1 now dot-sources and calls Invoke-LS2PostBuildPublish after Build-Module {} completes, so Publish-Module -Path $artefactRoot sees the fully vendored Modules\ tree
• Added colored [i]/[>]/[+]/[x] output matching PSPublishModule's style

Tests

Added Tests/Build/Build-Module.Tests.ps1 with 12 unit tests covering:

• vendoring always runs regardless of publish flag
• Publish-Module is not called when -PublishToPSGallery is absent
• -Path (not -Name) is passed to Publish-Module
• API key passed correctly via direct string or file path
• error written when publish requested but no key provided

CI Impact

No changes to publish.yml required — the workflow already passes $env:PSGALLERY_API_KEY via -PSGalleryAPIKey and Build-Module.ps1 forwards it through.