2.3.1
fix(node-publish): tarball path. The 2.3.0 node-publish template
wrote tarballs to ../dist (above CI_PROJECT_DIR), breaking the
artifacts:paths scope. Downstream node-sbom + slsa-attest failed.
Switched to \${CI_PROJECT_DIR}/dist consistently.