Combine the published_at and aasm_state migrations into one migration

The last deploy didn't work because the certificates relied on aasm_state being present, so I've rolled the migrations into two now and this should work.