BOLT-1268 P1 — idempotent publishWorkspaceProgramEvent (no re-executeBatch on already-published events)

Phase 1 of BOLT-1268. Backend safety fix that ships independently of the UI work. Short-circuit publishWorkspaceProgramEvent when publishedAt is already set; do NOT re-run executeBatch on every batch (current behavior double-dispatches commands when a user hits Edit→Schedule on a pending event). Defensive Datadog log on duplicate publish attempt. Tests: first publish executes batches; second publish no-ops and returns the same event. File: domains/program/src/services/workspaceProgramEvent/publishWorkspaceProgramEvent.ts.