feat(distribution): publish installer archives through R2

[e54-bot]

Summary

• publish verified native archives and checksums to the R2-backed installer routes after the GitHub Release is public
• advance latest/version only after public byte and cache-header verification
• move install.sh latest and pinned downloads to releases.wrightkit.dev while retaining mandatory checksum validation

Validation

• actionlint .github/workflows/release.yml
• scripts/test-install.sh
• python3 scripts/test-distribution-install-sh.py
• python3 scripts/verify-dist.py
• cargo fmt --all -- --check

Release configuration

Requires existing CLOUDFLARE_ACCOUNT_ID plus R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY. The workflow uses the configured wrightkit-release bucket and releases.wrightkit.dev custom domain.

Fixes #261

[Teakowa]

Blocking — .github/workflows/release.yml changes publish-tap to depend on publish-r2. #261 explicitly keeps package-manager ownership/publication out of scope unless this distribution contract requires it, and the updated docs state that Homebrew continues to consume the canonical GitHub Release artifacts. With this dependency, any R2 credential/domain/upload failure after a successful public GitHub Release also prevents the Homebrew tap from updating, coupling an otherwise independent release channel to R2. Keep publish-tap gated by package-manifests + publish-release, and let publish-r2 run independently after publish-release.

[e54-bot]

Addressed in a9a19a4: publish-tap again depends only on package-manifests and publish-release, while publish-r2 remains an independent post-release job. The release documentation now states that the R2 and Homebrew publication paths are independent.

[Teakowa]

LGTM