always have a publish workflow service even when workflow is disabled

this allows services that depend on the publish workflow checker to simplify their logic and avoids security issues by not using `on-invalid="ignore"` service arguments that risk typos.