fix(release): preserve alpha-tested promotion payload

[jack-champagne]

Important

Problem — Marketplace promotion can change the executable after alpha validation, while two independent infrastructure failures can strand a clean tag before Marketplace publication: an expired cross-repo credential and a failed Actions artifact finalization.
Approach — Build the BETA fork candidate before alpha, commit its exact release pin into the candidate, then rebuild and publish only that tagged payload in one job. Promotion never reads a live fork branch and never provisions a new binary.
Approaches considered — Rebuild during promotion was rejected because it invalidates alpha evidence. Reusing prebuilt artifact storage was rejected because artifact finalization failed and recovery must work from source. Manual fork release was rejected in favor of a least-privilege fine-grained PAT with an actionable preflight.
Scope — In: candidate provisioning, promotion integrity, idempotent Marketplace recovery, credential diagnostics. Out: publishing the existing DEV-channel v0.3.3 payload to Marketplace.
Assumptions — A maintainer will rotate and SSO-authorize the fine-grained REPO_ACCESS_TOKEN for the fork with Contents and Actions read/write.

Acceptance Criteria

• Candidate preparation performs a read-only fork credential preflight and reports rotation or SSO remediation on failure.
• Candidate preparation creates and verifies the BETA fork release before an alpha tag is cut.
• The alpha's committed release pin identifies the exact fork tag, commit, and platform hashes that stable promotion uses.
• Promotion rebuilds only from the alpha tag's immutable release pin and makes no cross-repository calls.
• Promotion packages and publishes all Marketplace targets in one job without an Actions artifact handoff.
• Retrying a partially failed release is idempotent: it rebuilds from the same tag, refreshes release assets safely, and skips Marketplace targets already published.
• v0.3.3 remains a GitHub direct-install recovery release; the first Marketplace release under this contract is v0.3.4.
• The real v0.3.4-alpha.1 flow proves candidate provisioning and validates the same BETA payload that reaches Marketplace.

Testing Decisions

• Add deterministic workflow/helper tests for credential preflight, immutable-pin selection, and retry classification.
• Run the extension package, contract parity, authenticated boot smoke, and migration-upgrade proof against the candidate payload.
• Exercise the cross-repository path through the real v0.3.4-alpha.1 candidate, then confirm promotion performs no fork provisioning.

Key Decisions

• The fine-grained PAT is used only by candidate preparation; stable promotion has no cross-repository authority.
• An alpha may carry the BETA binary that stable will ship, because alpha is the payload-validation surface.
• A stable release rebuilds from its tag rather than artifact storage, but its tag pin is immutable and complete.
• Marketplace publication is in the packaging job so release assets and publish attempts share one payload without artifact-service coupling.

Constraints & Invariants

• A Marketplace executable must be semantically identical to the payload tested in alpha.
• A clean tag must remain recoverable after partial GitHub Release or Marketplace failure.
• Release recovery must never reuse or retarget a published version.
• Cross-repository credential failures must happen before any fork tag or dispatch write.

Prior Art

• Existing alpha and promote workflows.
• The fork binary release workflow.
• The v0.3.3 failed provisioning and artifact-upload runs.

Notes

• v0.3.3-alpha.1 and its direct stable GitHub Release both validated the guarded amicode.19 migration repair. Marketplace publication did not start.

[jack-champagne]

Draft implementation is in #898. Human gate: rotate and SSO-authorize REPO_ACCESS_TOKEN for harmoniqs/opencode with Contents and Actions read/write, then run the real v0.3.4-alpha.1 candidate flow. v0.3.3 remains direct-install only; Marketplace publication never started.

[jack-champagne]

The regenerated PAT preflight succeeded. The real candidate exposed a DEV/BETA tag-ownership race; linked repairs are harmoniqs/opencode#313 and #904. The BETA candidate will be rerun after both merge.

[jack-champagne]

The repaired cross-repo candidate path passed end to end: BETA fork release v1.18.29-amicode.24 was dispatch-owned and pinned into release-0.3.4 at ba9e32c4. Next: validate and merge the release-preparation branch, then cut v0.3.4-alpha.1.

[jack-champagne]

Release-preparation PR #906 now carries the proven BETA candidate lock v1.18.29-amicode.24 and authenticated smoke fix. After its CI passes and it merges, the next step is the real v0.3.4-alpha.1 validation.