fix: publish release artifacts after successful image retagging (#1964)

Successful release fast paths publish image tags but never dispatch the
job that creates the GitHub release and decrypt binaries. Dispatch
`deploy.yml` from both image routes. A default-off `images_published`
input skips E2E and image rebuilding only for an already-published tag;
missing or mismatched images keep the complete fallback without
requiring new inputs on older workflow definitions.

Go validation still gates the release binaries, checkout and version
flags retain the tagged source, and the existing release action uploads
both architectures before publication. Missing binary files now fail
publication.

Fixes #1956.

Validation:

- `node test-issue-1956-release-routing.js` executes the actual workflow
shell steps with registry and dispatch commands stubbed. Covers
matching, missing and mismatched images; failed retag and Go validation;
branch/PR boundaries; and both tagged binary commands.
- The original test commit fails because a matching image dispatches
zero artifact workflows; the fix passes the same assertion.
- Existing release workflow Go checks, decrypt/channel tests, YAML
parsing and actionlint pass.
- Both static Linux amd64 and arm64 binaries cross-build with verified
architecture and version metadata.

Actual registry publication and GitHub release creation were not
exercised. Existing immutable releases and old tags that contain older
workflow definitions are outside this fix.

Following #1922, this is a focused release-routing PR. A separate repair
for #1858 rewrites the shared frontend test runner; merging this first
lets that repair retain this regression in its authoritative list.
Please assess current Go and E2E job results separately from
workflow-approval or staging-runner state.

.github/workflows/deploy.yml

@@ -18,6 +18,11 @@ on:
   pull_request:
     branches: [master]
   workflow_dispatch:
+    inputs:
+      images_published:
+        description: 'Release fast path already published the tag images'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -235,6 +240,7 @@ jobs:
           node test-issue-1705-subpath-contrast.js
           node test-issue-1770-mobile-row-clamp.js
           node test-a11y-axe-routes-coverage.js
+          node test-issue-1956-release-routing.js
 
       - name: 🛡️ Preflight XSS gate — actual --diff check (PR only)
         # The fixture self-test above (test-preflight-xss-gate.js) only
@@ -322,7 +328,7 @@ jobs:
     defaults:
       run:
         shell: bash
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' && !(startsWith(github.ref, 'refs/tags/v') && inputs.images_published)
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -665,7 +671,7 @@ jobs:
     name: "🏗️ Build & Publish Docker Image"
     needs: [e2e-test, changes]
     runs-on: ubuntu-latest
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' && !(startsWith(github.ref, 'refs/tags/v') && inputs.images_published)
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -768,8 +774,11 @@ jobs:
           CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${{ github.ref_name }}" -o ../../corescope-decrypt-linux-arm64 .
 
       - name: Upload release assets
+        # Standard releases upload both assets to a draft before publishing.
+        # Keep one writer: published releases are immutable in this repository.
         uses: softprops/action-gh-release@v2
         with:
+          fail_on_unmatched_files: true
           files: |
             corescope-decrypt-linux-amd64
             corescope-decrypt-linux-arm64