devops: pass npm dist-tag to ESRP via productstate

[Yury Semikhatsky (yury-s)]

Summary

• Pass the next dist-tag to EsrpRelease@11 via productstate, the mechanism used by other npm ESRP publishers.
• Drop the publishConfig.tag injection from the pack step — tarballs are now identical to a regular publish.

[github-actions]

Test results for "MCP"

1 failed
❌ [chromium] › mcp/cli-save-as.spec.ts:19 › screenshot @mcp-macos-latest-chromium

8049 passed, 1284 skipped

---

Merge workflow run.

[github-actions]

Hi, I'm the Playwright bot and I took a look at the failing CI.

🟢 The one failure is a pre-existing flake — this PR is clear

[chromium] › mcp/cli-save-as.spec.ts:19 › screenshot timed out on mcp-macos-latest-chromium. This PR only edits .azure-pipelines/publish.yml (npm dist-tag handling for the ESRP publish), which has no reach into the MCP screenshot path, and that exact bot has passed this test 656 of 657 runs — the single red is this run itself.

Details

Pre-existing flake / infra

• [chromium] › mcp/cli-save-as.spec.ts:19 › screenshot on mcp-macos-latest-chromium — failed with a bare Test timeout of 30000ms exceeded., a classic flake signature. Across the test-results DB this test is essentially always green on that bot: 1 failed / 656 passed of 657 runs, and the one failure is this PR's own run (sha 79f1f4a). The same test also failed once on main back on 2026-07-21 (mcp-windows-latest-chrome, run 29844140319, sha 06b65dc) — a SHA this PR can't be responsible for — so it flakes independently of this change.

  Run history on mcp-macos-latest-chromium (oldest→newest, last 15): 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟥 — the trailing red is this run.

Impact of this PR: the diff is release-pipeline-only (pass productstate: 'next' to EsrpRelease@11, drop the publishConfig.tag injection from the pack step). It doesn't touch product code, tests, or the CI test runner, so it can't cause an MCP screenshot timeout.

_{Triaged by the Playwright bot - agent run}

[github-actions]

Test results for "tests 1"

5 flaky

⚠️ [chromium-library] › library/video.spec.ts:664 › screencast › should capture full viewport `@realtime-time-library-chromium-linux`
⚠️ [chromium-library] › library/chromium/chromium.spec.ts:299 › should report intercepted service worker requests in HAR `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/video.spec.ts:736 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/beforeunload.spec.ts:130 › should support dismissing the dialog multiple times `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-page] › page/page-event-request.spec.ts:181 › should return response body when Cross-Origin-Opener-Policy is set `@firefox-ubuntu-22.04-node20`

51232 passed, 1190 skipped

---

Merge workflow run.