Defer public GitHub Release until provider artifacts and R2 are ready

[Teakowa]

Parent: wrightkit/.github#49

Goal

Make a public opy-rs GitHub Release represent a complete first-party release: the exact release revision has passed required gates, every supported opy-provider artifact has been built and verified, and the immutable provider artifact set is publicly available and checksum-consistent through R2.

Context

The release contract includes both Rust package publication and first-party provider binaries consumed through the WrightKit distribution path. A public GitHub Release must therefore not imply completion before the required provider artifacts are available and verified.

Scope

• Preserve release-plz ownership of crate versioning, release PR maintenance, intended crates.io publication, and release tag identity.
• Prevent the product GitHub Release from becoming public before repository-specific provider publication is complete.
• Build the supported opy-provider target matrix from the exact release revision and stage each archive/checksum once.
• Reuse the staged provider artifacts for GitHub Release assets and R2 publication; do not rebuild for either destination.
• Publish immutable opy-rs/releases/<version>/... provider objects to R2 and publicly verify them before public GitHub Release promotion.
• Make the GitHub Release public only after the required provider artifact set is complete and verified.
• Advance opy-rs/latest/version only when the immutable R2 artifact set is verified and the canonical GitHub Release is public.
• Preserve artifact naming, checksums, target support, crates.io package behavior, and Wright consumer URL contracts.

Non-goals

• Replacing release-plz as the crate release/versioning mechanism.
• Changing OPY source/compiler semantics, provider runtime behavior, LPP, or Wright consumer behavior.
• Changing provider artifact names, supported targets, checksums, or the R2 namespace.
• Removing crates.io publication for packages intentionally published by this repository.
• Introducing another tag-triggered release lifecycle, polling loop, or release rediscovery protocol.
• Moving provider-specific build/publication logic into the shared .github repository.
• Weakening package/provider correctness gates to shorten releases.

Acceptance criteria

• A release revision cannot become a public opy-rs GitHub Release before its required correctness/release gates succeed.
• Every supported provider archive/checksum is built and verified before public promotion.
• GitHub Release assets and R2 objects consume the same staged provider artifacts without rebuilding them.
• Every required immutable R2 provider archive/checksum is publicly retrievable and checksum-consistent before the GitHub Release becomes public.
• A provider build, package, checksum, R2 upload, or R2 verification failure leaves no newly public GitHub Release representing a complete provider release.
• opy-rs/latest/version never points to a version lacking the complete immutable artifact set and a public canonical GitHub Release.
• Existing crates.io publication, release tag/version identity, provider target matrix, artifact names, checksums, and Wright R2 consumer paths remain regression-green.
• Independent release-flow verification demonstrates that failing provider/R2 verification prevents public GitHub Release promotion.

Dependencies / ownership

• Organization-level release policy and reusable workflow boundaries: Audit CI work reuse and release publication ordering across WrightKit .github#49.
• opy-rs owns provider build, packaging, publication, and repository-specific release orchestration.
• Shared .github changes are appropriate only for repository-agnostic release contracts.