publish: per-package mode ignores dependency order and pushes each tag before the branch #735

Problem

Per-package mode runs whenever any update carries a tag (packages/publish/src/pipeline/index.ts:66). That covers:

• the single strategy;
• the async strategy;
• version.groups;
• sync with packageSpecificTags.

Three problems in this mode:

1. Dependency order is lost.
   • The loop gives each stage a context with only one update (index.ts:108-136). So these each see a single target and can't order anything:
     • orderNpmUpdates (registry/npm.ts:43-82);
     • the cargo topological sort and publishOrder (registry/cargo.ts:156-200);
     • pub publishOrder (registry/pub.ts:128-150).
   • The actual order is the order of VersionOutput.updates, which is discovery order.
   • A dependent crate can therefore publish before its path dependency, and cargo publish then fails on every retry.
   • docs/rust.md:15,143-165 and docs/dart.md:18,146-161 promise this ordering.
2. Each tag is pushed before the branch.
   • pushPackageTag pushes refs/tags/<tag>, then the branch (stages/git-push.ts:118-128).
   • Batch mode does the reverse and explains why branch-first is safer (git-push.ts:183-189).
   • If a ruleset rejects the branch push, an orphan tag is left on the remote.
3. "Re-run failed jobs" after a partial publish probably fails (traced).
   • The re-run recreates the release commit at a new SHA.
   • stages/git-commit.ts:105-127 then finds the earlier packages' tags at a different commit and throws GIT_TAG_ERROR.

Fix

• Before the loop, sort input.updates the same way the batch stages do.
• Push the branch before the tag.
• Add tests for both.
• For (3), decide between a code fix and a documented recovery: roll forward with the next release.

Found in the 2026-10-23 docs review.