fix: archive build output as a single tarball instead of raw glob paths

[abueide]

Summary

The first real workflow_dispatch test of the shared-build-artifact setup (#1394) failed: deploy-cdn and purge-cdn-cache:consent both errored on a missing .../dist/umd directory, even though the build job's own build step produced it correctly - confirmed locally, a clean yarn build --force does produce packages/browser/dist/umd and packages/consent/*/dist/umd.

Root cause

upload-artifact was given two separate glob patterns:

path: |
  packages/*/dist
  packages/consent/*/dist

With more than one path pattern, it computes a shared least-common-ancestor root across all matched files and strips it from the archived paths. Since packages/consent/*/dist sits one directory level deeper than packages/*/dist, the LCA came out as packages/ and got stripped inconsistently - on download-artifact's side, the restored files landed one level too shallow (e.g. ./browser/dist/umd instead of ./packages/browser/dist/umd).

Fix

Tar the exact same paths into a single file in the build job (tar preserves relative paths exactly - no LCA-guessing involved), upload/download that one file instead of raw directory globs, then extract it after download in publish and deploy-cdn.

Verification

Reproduced and confirmed the fix locally:

tar -czf release-dist.tar.gz packages/*/dist packages/consent/*/dist
tar -xzf release-dist.tar.gz -C /tmp/extract-test
ls /tmp/extract-test/packages/browser/dist/umd/index.js   # exists
ls /tmp/extract-test/packages/consent/consent-wrapper-onetrust/dist/umd/  # populated

Both land at the exact expected paths.

Test plan

• Manual workflow_dispatch run: build uploads the tarball, publish and deploy-cdn both extract it and find dist/umd present at the expected path this time

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 07383af

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.59%. Comparing base (0d0238f) to head (4a6fc09).

⚠️ Current head 4a6fc09 differs from pull request most recent head 07383af

Please upload reports for the commit 07383af to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1395   +/-   ##
=======================================
  Coverage   91.59%   91.59%           
=======================================
  Files         127      127           
  Lines        4142     4142           
  Branches     1033     1033           
=======================================
  Hits         3794     3794           
  Misses        348      348           

Flag	Coverage Δ
browser	92.51% <ø> (ø)
core	90.07% <ø> (ø)
node	89.43% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.