Add error handling for failed publishing

Problem/Motivation

The `wse_task_monitor` submodule tracks workspace publish progress by creating a "running" task record in the expirable `keyvalue` store on the `WorkspacePrePublishEvent`, and marking it completed on the `WorkspacePostPublishEvent`. When a publish throws an exception, the post-publish event is never dispatched, so the task is never marked complete or failed. It lingers in running state for one hour (the `keyvalue` TTL).

Separately, the workspace publish form attaches a JS library that opens an SSE stream and renders one progress bar per non-finished task it finds in the `keyvalue` store, regardless of whether that task came from the current request or a previous failed attempt. So every failed publish leaves one orphaned progress bar that will appear to every user viewing the publish form for the next hour.

Steps to reproduce

Throw an exception on workspace publishing - this can be achieved by running a simple listener that fires after the publish event.

Proposed resolution

The cleanest/simplest fix is to add failure handling to `WorkspacePublishingTaskMonitor`. We can subscribe to a kernel exception and mark the active task as Failed when an exception escapes publish. That keeps the server side events completion semantics working (since the task transitions to Failed and the JS clears the bar) and lets users see that the publish failed instead of staring at a 0% bar.

Remaining tasks

User interface changes

API changes

Data model changes