Publish the GitHub Release only after verified R2 staging #293

Parent: wrightkit/.github#49
Supersedes the release-promotion ordering established by #283.

Goal

Make Wright's public GitHub Release a promotion step that occurs only after the exact release revision has passed its required gates, all supported native artifacts have been built and verified, and the immutable R2 release objects are publicly available and checksum-consistent.

Context

Wright's current release workflow builds and verifies native artifacts, publishes the draft GitHub Release, and only then publishes the verified archives to R2. This can expose a completed-looking public GitHub Release while the first-party R2 distribution path is still incomplete or has failed.

GitHub Releases remain Wright's canonical release/provenance record. R2 remains the binary distribution surface. The public canonical release should not get ahead of the distribution artifacts required by the released installer contract.

Scope

• Require the authoritative correctness/release gates for the exact release revision before public promotion.
• Build, package, checksum, and smoke-test every supported native release target once for the release transaction.
• Reuse the verified packaged artifacts for both GitHub Release assets and R2 publication; do not create a second release build path.
• Publish the immutable wright/releases/<version>/... R2 archive/checksum objects before making the corresponding GitHub Release public.
• Verify the public R2 objects against the staged release artifacts before GitHub Release promotion.
• Keep the GitHub Release draft/staging state non-public until the required R2 versioned artifact set is ready.
• Advance wright/latest/version only when the immutable R2 artifacts are verified and the canonical GitHub Release is public, so consumers cannot observe a release that lacks its canonical release record or complete artifact set.
• Preserve existing release revision/tag identity, checksum, package-manifest, installer, and supported-target contracts.

Non-goals

• Changing Wright's versioning or release-please release-PR model.
• Replacing GitHub Releases as the canonical release/provenance record.
• Replacing R2 as the first-party binary distribution surface.
• Changing artifact names, formats, supported targets, or installer URL structure.
• Rebuilding artifacts separately for GitHub and R2.
• Redesigning Homebrew, Scoop, WinGet, or other package-manager ownership unless a dependency-order adjustment is strictly required by this promotion boundary.
• Weakening release gates or native smoke coverage to reduce release duration.

Acceptance criteria

• A release revision cannot become a public GitHub Release before its required correctness/release gates succeed.
• Every supported native archive/checksum is built, packaged, and smoke-tested before public promotion.
• The exact verified artifacts intended for the GitHub Release are published to immutable wright/releases/<version>/... R2 paths without rebuilding them.
• Every required versioned R2 archive/checksum is publicly retrievable and checksum-consistent before the GitHub Release becomes public.
• A build, package, checksum, smoke, R2 upload, or R2 verification failure leaves no newly public GitHub Release for that version.
• wright/latest/version does not advance for a failed or partially published release and never points to a version lacking a public canonical GitHub Release.
• GitHub Release assets and R2 objects remain byte/checksum-consistent because both consume the same staged artifacts.
• Existing release tag/version identity, package manifests, installers, and supported-target behavior remain regression-green.
• Independent release-flow verification demonstrates that failing the R2 verification stage prevents GitHub Release promotion.

Dependencies / ownership

• Parent CI/release audit: Audit CI work reuse and release publication ordering across WrightKit .github#49 .
• Simplify R2 release publication around versioned artifacts #283 remains the durable R2 namespace/immutability contract, but its completed workflow ordering is superseded here.
• wright owns release staging, R2 publication, GitHub Release promotion, installers, and package-manager metadata.
• Shared .github changes are allowed only if [M8] Finalize v1 compatibility matrix and S/D/N/E release gates #49 demonstrates a genuinely reusable cross-repository contract.