fix(release): align publication with built artifacts

[edgyarmati]

Summary

Repairs the v0.4.4 publication blocker exposed by release workflow run 33152767977 after all platform builds and the signed Sparkle feed had succeeded. The publish job was validating stale filenames and asset classes instead of the artifacts generated by the current Electron Builder and Sparkle pipeline.

Failure observed

The release publisher rejected the retained build output because it expected:

• GedCode-0.4.4-x64.AppImage, while Electron Builder emits GedCode-0.4.4-x86_64.AppImage and writes that name into latest-linux.yml.
• latest-mac.yml and promoted nightly-mac.yml, although production macOS updates now use the separately generated, Ed25519-signed Sparkle appcast.

The build-artifact collector also admitted builder-debug.yml and macOS ZIP blockmaps. The strict validator would have rejected those as unexpected immediately after the missing-file check was corrected. Finally, the real Linux manifest contains valid per-file blockMapSize metadata that the narrow manifest parser did not understand.

Changes

• Replace extension-wide artifact collection with an exact per-platform allowlist derived from the resolved release version and channel.
  • macOS: arm64 DMG and ZIP only.
  • Linux: x86_64 AppImage and channel-specific Linux manifest.
  • Windows: x64 installer, installer blockmap, and channel-specific manifest.
• Fail during the platform build job if any exact required artifact is absent, instead of waiting until the publication job after every platform has completed.
• Align strict publication validation with Electron Builders x86_64 AppImage filename.
• Remove legacy electron-updater macOS YAML manifests from the GitHub release contract; the independently signed and verified Sparkle appcast remains the authoritative macOS update feed.
• Parse, compare, and serialize extra scalar metadata attached to individual updater files, preserving blockMapSize rather than rejecting or discarding it.
• Update release fixtures and add regression coverage for rejecting legacy macOS manifests and round-tripping per-file updater metadata.
• Document the release-path correction in the v0.4.4 changelog section.

Repository state change

Before this PR, current cross-platform builds completed successfully but stable release publication could never pass the repositories own strict validator. Broad artifact globs also allowed diagnostics and unused metadata into the merge directory.

After this PR, each platform uploads only its exact publishable contract, the publisher validates the filenames and manifest structure Electron Builder actually emits, and macOS release metadata is unambiguously owned by Sparkle.

Verification

• bun fmt
• bun lint (passes; existing non-blocking warnings remain)
• bun run --filter=@t3tools/scripts typecheck
• bun run --filter=@t3tools/scripts test -- validate-release-assets.test.ts publish-github-release.test.ts promote-stable-update-manifests.test.ts merge-update-manifests.test.ts — 4 files, 23 tests passed
• bun run release:smoke
• git diff --check
• Rehearsed promotion and strict validation against the retained real artifacts from failed v0.4.4 run 33152767977: 9 stable release assets validated successfully.

Release retry

Once merged and green on main, rerun ./release.sh stable patch. The resulting v0.4.4 tag must target the newly reviewed merge SHA; artifacts from the failed run are used only as validation fixtures and will not be published under the new tag.