fix: canonical workflow improvements — stale action SHAs, publish.yml modernisation, and reusable rule workflows

## Summary

Several improvements to the canonical workflow files in this repo have been identified. This issue tracks all pending changes and serves as a running change log — each change made to a canonical file in this repo during the current work cycle will be recorded as a comment on this issue.

---

## 1. `publish.yml` — stale action versions and Node 16

`publish.yml` currently uses outdated action versions and an EOL Node.js runtime:

| Item | Current | Target |
|------|---------|--------|
| `actions/checkout` | `@v3` | `@v4` |
| `actions/setup-node` | `@v3` | `@v4` |
| `node-version` | `16.x` | `20.x` |

Node.js 16 reached end-of-life in September 2023. `actions/checkout@v4` and `actions/setup-node@v4` have been available and stable since late 2023.

> **Note:** Node 16 removal from `node.js.yml` is tracked separately in [#63](https://github.com/frmscoe/workflows/issues/63). This item covers `publish.yml` specifically.

**Acceptance criteria:**
- [ ] `publish.yml` uses `actions/checkout@v4` and `actions/setup-node@v4`
- [ ] `publish.yml` uses `node-version: '20.x'` (or `lts/*`)
- [ ] Change propagated to all downstream frmscoe repos via sync

---

## 2. `package-rule.yml` + `package-rule-rc.yml` — promote to reusable workflows

Every frmscoe rule repo (33 repos) plus `tazama-lf/rule-901` and `tazama-lf/rule-902` each carry their own full copy of these two files — **70 nearly-identical files** maintained individually.

The right solution is to define these as [reusable workflows](https://docs.github.com/en/actions/sharing-automations/reusing-workflows) with `workflow_call` inputs here in canonical, allowing each downstream repo to have a thin caller file instead of a full job definition.

**Known issues with current copies to fix in the canonical form:**
- Docker image tag is hardcoded as `3.0.0` in all copies — must be dynamic (derived from `package.json` or passed as a workflow input)
- `rule-002` has a more robust implementation (reads existing dependency version from `rule-executer/package.json` before overwriting) — adopt this pattern as canonical

**Acceptance criteria:**
- [ ] `package-rule.yml` defined as a reusable `workflow_call` with `rule_number` input (and optionally `image_tag`)
- [ ] `package-rule-rc.yml` same treatment
- [ ] Dynamic version tag replaces hardcoded `3.0.0`
- [ ] Canonical implementation uses the `rule-002` defensive pattern for dependency version checking
- [ ] All 35 downstream rule repos updated to call the reusable workflow

---

## Related

- [frmscoe/workflows#63](https://github.com/frmscoe/workflows/issues/63) — Node 16 removal from `node.js.yml` (parallel track)
- [tazama-lf/workflows#23](https://github.com/tazama-lf/workflows/issues/23) — equivalent canonical improvements for tazama-lf/workflows