@bitsandfoxes reported that craft publish fails at the very end (after all targets succeed) if the repo is in a dirty state. We should either detect this earlier and bail early, or work around it.