fix(ci): exclude node_modules from release artifact to avoid OOM

The release/publish workflow's build job uploads the entire workspace
as an artifact for the publish job to download. With node_modules and
build caches included, this monorepo produces ~6.4M files, which OOMs
upload-artifact's Node process at its 4GB heap limit during
enumeration:

  FATAL ERROR: Ineffective mark-compacts near heap limit
  Allocation failed - JavaScript heap out of memory

Excluding node_modules, .next, .turbo, and .nx cuts the file count by
orders of magnitude. The publish job runs `pnpm install --frozen-lockfile`
after download to restore node_modules deterministically from
pnpm-lock.yaml (carried in the artifact), so the publish step still
runs against exactly the resolved dependency tree the build job used.

Fixes the upload step that hung for 12+ minutes and then OOM'd when
the workflow_dispatch trigger added in CopilotKit#4808 was first exercised.

Author: claude

.github/workflows/publish-release.yml

@@ -91,11 +91,21 @@ jobs:
       - name: Build packages
         run: pnpm run build
 
+      # Exclude node_modules and build caches from the artifact. Including
+      # them produces ~6.4M files for this monorepo, which OOMs
+      # upload-artifact's Node process at its 4GB heap limit during
+      # enumeration. The publish job runs `pnpm install` after download to
+      # restore node_modules from pnpm-lock.yaml.
       - name: Upload workspace
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: workspace
-          path: .
+          path: |
+            .
+            !**/node_modules/**
+            !**/.next/**
+            !**/.turbo/**
+            !**/.nx/**
           include-hidden-files: true
           retention-days: 1
 
@@ -132,6 +142,13 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      # Restore node_modules — the build job excludes them from the
+      # uploaded workspace artifact (see "Upload workspace" above). Uses
+      # pnpm-lock.yaml from the artifact, so this is a deterministic
+      # restore of exactly what the build job ran with.
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Configure npm auth
         run: |
           npm config set "//registry.npmjs.org/:_authToken" "${NPM_TOKEN}"