For tx.upgrade(), adding --ignore-chain to the build command helped me to achieve same digest as generated by upgrade --dry-run and solved the PublishErrorNonZeroAddress for package upgrading.
tx.upgrade()
--ignore-chain
upgrade --dry-run
PublishErrorNonZeroAddress