publish: Upload tarball *before* sending version data

This reduces the likelihood that there'll ever be a package that has a
'latest' version that doesn't have a tarball associated with it, and
that's a good thing.
v0.2.17