The problem is that you need to publish the JavaScript bundle for the app to be able to load it.
My understanding of all the finer details might be slightly lacking, but I understand it as follows:
“Publishing” basically builds/bundles the JavaScript code and then uploads it.
“Building” without publishing builds the app binary.
So if you e.g. make changes to the permission description strings in app.json then you need to build a new binary, but you don’t need to change the JavaScript. In that case you do not need to publish a new JavaScript bundle. This is the sort of thing that the --no-publish option is for.
If you make changes to the JavaScript, but don’t publish them, then the newly built binary will download the latest published JavaScript bundle. This is what you’re seeing.
I believe something like the following will work for you:
Build a new binary with a release channel of e.g. “staging”. When you want to test changes, publish them to the “staging” channel.
When you’re happy that they are working correctly, promote the published JavaScript bundle to the “production” release channel.
See also @llamaluvr’s posts about this sort of thing: