fix: publish release artifacts after successful image retagging (#1964)

Successful release fast paths publish image tags but never dispatch the
job that creates the GitHub release and decrypt binaries. Dispatch
`deploy.yml` from both image routes. A default-off `images_published`
input skips E2E and image rebuilding only for an already-published tag;
missing or mismatched images keep the complete fallback without
requiring new inputs on older workflow definitions.

Go validation still gates the release binaries, checkout and version
flags retain the tagged source, and the existing release action uploads
both architectures before publication. Missing binary files now fail
publication.

Fixes #1956.

Validation:

- `node test-issue-1956-release-routing.js` executes the actual workflow
shell steps with registry and dispatch commands stubbed. Covers
matching, missing and mismatched images; failed retag and Go validation;
branch/PR boundaries; and both tagged binary commands.
- The original test commit fails because a matching image dispatches
zero artifact workflows; the fix passes the same assertion.
- Existing release workflow Go checks, decrypt/channel tests, YAML
parsing and actionlint pass.
- Both static Linux amd64 and arm64 binaries cross-build with verified
architecture and version metadata.

Actual registry publication and GitHub release creation were not
exercised. Existing immutable releases and old tags that contain older
workflow definitions are outside this fix.

Following #1922, this is a focused release-routing PR. A separate repair
for #1858 rewrites the shared frontend test runner; merging this first
lets that repair retain this regression in its authoritative list.
Please assess current Go and E2E job results separately from
workflow-approval or staging-runner state.

.github/workflows/deploy.yml

@@ -18,6 +18,11 @@ on:
   pull_request:
     branches: [master]
   workflow_dispatch:
+    inputs:
+      images_published:
+        description: 'Release fast path already published the tag images'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -235,6 +240,7 @@ jobs:
           node test-issue-1705-subpath-contrast.js
           node test-issue-1770-mobile-row-clamp.js
           node test-a11y-axe-routes-coverage.js
+          node test-issue-1956-release-routing.js
 
       - name: 🛡️ Preflight XSS gate — actual --diff check (PR only)
         # The fixture self-test above (test-preflight-xss-gate.js) only
@@ -322,7 +328,7 @@ jobs:
     defaults:
       run:
         shell: bash
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' && !(startsWith(github.ref, 'refs/tags/v') && inputs.images_published)
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -665,7 +671,7 @@ jobs:
     name: "🏗️ Build & Publish Docker Image"
     needs: [e2e-test, changes]
     runs-on: ubuntu-latest
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' && !(startsWith(github.ref, 'refs/tags/v') && inputs.images_published)
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -768,8 +774,11 @@ jobs:
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${{ github.ref_name }}" -o ../../corescope-decrypt-linux-arm64 .
 
       - name: Upload release assets
+        # Standard releases upload both assets to a draft before publishing.
+        # Keep one writer: published releases are immutable in this repository.
         uses: softprops/action-gh-release@v2
         with:
+          fail_on_unmatched_files: true
           files: |
             corescope-decrypt-linux-amd64
             corescope-decrypt-linux-arm64

.github/workflows/release-fast-path.yml

@@ -1,10 +1,10 @@
 name: Release Fast-Path
 
 # Issue #1677: re-tag :edge as :vX.Y.Z when the tag SHA matches :edge's
-# org.opencontainers.image.revision label. Skips ~30 min of Go test +
-# Playwright + Docker rebuild because the bytes are identical — only the
-# manifest name changes. Falls back to deploy.yml when SHAs differ so
-# tags on older commits still go through full validation.
+# org.opencontainers.image.revision label. Skips Playwright + Docker rebuild
+# because the application bytes are identical. Both paths dispatch deploy.yml
+# for Go validation and release binaries; mismatched SHAs also run the full
+# image pipeline so tags on older commits still go through full validation.
 #
 # This workflow is the SOLE consumer of push.tags. deploy.yml's tag
 # trigger has been removed to prevent double-fire.
@@ -16,7 +16,7 @@ on:
 permissions:
   contents: read
   packages: write
-  actions: write   # issue #1702: required so the fallback `gh workflow run deploy.yml` dispatch is allowed
+  actions: write   # issue #1702: required for the `gh workflow run deploy.yml` dispatch
 
 concurrency:
   group: release-fast-path-${{ github.ref }}
@@ -24,7 +24,7 @@ concurrency:
 
 jobs:
   retag-or-fallback:
-    name: "🏷️ Re-tag :edge → :vX.Y.Z (fast) or dispatch deploy.yml (fallback)"
+    name: "🏷️ Re-tag :edge and dispatch release artifacts or full fallback"
     runs-on: ubuntu-latest
     steps:
       - name: Log in to GHCR
@@ -115,17 +115,22 @@ jobs:
           done
           echo "Fast-path complete — release tags point at :edge plus a one-file version layer."
 
-      # ─────────── FALLBACK: SHAs differ, run the full pipeline ───────────
-      - name: Dispatch full deploy.yml pipeline (fallback)
-        if: steps.edge.outputs.no_edge == 'true' || steps.edge.outputs.edge_revision != github.sha
+      # Both image routes need the single release-artifacts writer in deploy.yml.
+      - name: Dispatch release artifacts or full deploy.yml pipeline
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          echo "SHA mismatch (or no :edge) — falling back to full pipeline"
-          echo "  :edge revision = '${{ steps.edge.outputs.edge_revision }}'"
-          echo "  tag SHA        = '${{ github.sha }}'"
+          DISPATCH_ARGS=()
+          if [[ "${{ steps.edge.outputs.no_edge == 'false' && steps.edge.outputs.edge_revision == github.sha }}" == 'true' ]]; then
+            echo "Images published — dispatching Go validation and release artifacts"
+            DISPATCH_ARGS+=(--field images_published=true)
+          else
+            # No new inputs: an older tag may have an older deploy.yml schema.
+            echo "SHA mismatch (or no :edge) — falling back to full pipeline"
+          fi
           gh workflow run deploy.yml \
             --repo "${{ github.repository }}" \
-            --ref "${{ github.ref }}"
+            --ref "${{ github.ref }}" \
+            "${DISPATCH_ARGS[@]}"
           echo "Dispatched deploy.yml against ${{ github.ref }}"