Pin publish action to working v1 commit (supply-chain hardening)

Pin Comfy-Org/publish-node-action to commit 0eb6cd742945443bee7f79eeddd4f732780029a1 (the v1 head) so a moved
tag cannot inject code. NOTE: the 1.0.1 release tag is broken (runs the
removed 'comfy --yes' flag); this commit uses 'comfy --skip-prompt' and works.

.github/workflows/publish.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
       - name: Publish Custom Node
-        uses: Comfy-Org/publish-node-action@v1
+        uses: Comfy-Org/publish-node-action@0eb6cd742945443bee7f79eeddd4f732780029a1  # v1 (1.0.1 tag broken: removed comfy --yes flag)
         with:
           ## Add your own personal access token to your Github Repository secrets and reference it here.
           personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }}