ci(.github): publish release ISOs as artifacts, share the ISO table

[phorcys420]

What

Tagged releases were failing while uploading the ISOs:

Error: Validation Failed: {"resource":"ReleaseAsset","code":"custom","field":"size","message":"size must be less than 2147483648"}

GitHub release assets are hard-capped at 2 GiB and the box ISOs now exceed that. This reworks the release flow to publish each ISO as a GitHub Actions artifact instead, and carries a size + download table in the release body.

Note

This is an interim step. The ISOs will move to an S3 URL later; at that point only the upload steps and the iso-table links change. The release currently has no downloadable release assets — the table links to Actions artifacts (GitHub login required, 90-day retention, the public-repo max).

Changes

• release.yml: upload ISO + .sha256 as one artifact per kind (coder-box-<target>-<system>, 90-day retention); drop the >2 GiB release-asset upload. The release job downloads only the tiny size metadata, renders the shared table, and sets it as the release body.
• .github/actions/iso-table (new): the PR sticky-comment table renderer extracted into a reusable composite action. Outputs table; sticky-comment: true upserts the PR comment (test workflow), the release workflow feeds table into the release body. expiry-days drives the footer (1 for PRs, 90 for releases).
• build-iso: new system input; folds ISO size recording (iso-sizes-<target>-<system>.tsv) into the action so both workflows get metadata for free.
• test.yml: swap ~90 lines of inline github-script for the shared action; add checkout + actions: read.

Validation

• actionlint clean; node --check + shellcheck on the embedded blocks clean.
• Ran the renderer against mock metadata: sorts installer→appliance, formats sizes, maps artifact URLs, footer shows ~90 days.

Design notes / decisions

• Why artifacts, not compression/split? Requested interim approach; artifacts have no per-file size cap and are free on public repos. Compression risks a single image still exceeding 2 GiB; split assets are ugly. S3 is the real long-term answer.
• Retention = 90 days: the max allowed for public repositories (private/internal can go to 400). Footer expiry note matches.
• Naming/collision safety: size TSVs are named iso-sizes-<target>-<system>.tsv and metadata artifacts iso-meta-<target>-<system> so merge-multiple downloads never clash when installer + appliance share an arch (the release matrix is per-kind×arch = 4 jobs).
• Table links resolve artifacts from the current run via listWorkflowRunArtifacts (hence the added actions: read), the same artifacts each workflow just uploaded.

---

Opened by Coder Agents on behalf of @phorcys420.