Make DevTools publishing independently retryable

[KidkArolis]

What changed

• split the DevTools release into a shared build plus independent Firefox and Chrome publisher jobs
• replace the opaque web-ext sign CLI call with a wrapper that reports the safe AMO HTTP status, content type, and request ID
• retry only upload and validation failures, before an add-on version can have been submitted
• document the independent retry behavior

Why

The DevTools 0.3.0 release reached AMO signing but received an HTML response where web-ext expected JSON. The CLI hid the response status and request metadata, and the single sequential job prevented Chrome submission after Firefox failed.

This keeps publisher failures isolated and makes the next AMO run actionable without logging credentials or retrying a potentially-created extension version.

Validation

• npm run test — 357 tests passed, including typecheck, lint, and formatting
• workflow YAML parsed locally
• signer exercised with dummy credentials: reported AMO 401, JSON content type, and request ID without retrying or exposing credentials
• branch workflow run: shared build passed; GitHub correctly blocked the publisher because extension-release permits only master, so protected-secret verification must happen after merge