ci: optimize and validate release workflow

[khanra17]

Summary

• add a non-publishing workflow_dispatch validation mode that packages and verifies every release target without mutating GitHub Releases
• build and cache the production frontend and CGO-free sidecars once, in parallel, then share those verified inputs with native jobs
• add isolated Rust and Tauri caches while preserving the production Cargo profile, signing, updater artifacts, manifests, checksums, and Homebrew publication
• model native macOS builds as a matrix and produce Universal artifacts from the two already-built native executables instead of compiling both architectures again
• add platform-specific validation artifacts, normalized checksums, complete updater-manifest validation, concise job names, and job summaries
• cancel only superseded non-publishing manual validations; tag and explicit publishing runs remain non-cancellable

Workflow graph

The graph shows frontend and sidecar preparation running concurrently, native macOS architectures grouped as a matrix, Linux architectures grouped as a matrix, and Universal packaging consuming the completed native macOS outputs.

Runtime comparison

Baseline: latest successful upstream release, v1.3.14.

Optimized: successful full non-publishing package validation, 30379835778.

Stage	Upstream	Optimized	Reduction
End-to-end workflow	48m 39s	15m 39s	67.8%
Windows x64 job	25m 13s	14m 10s	43.8%
macOS arm64 job	19m 31s	12m 26s	36.3%
macOS x64 job	18m 52s	6m 37s	64.9%
Ubuntu x64 job	18m 19s	11m 56s	34.8%
Ubuntu arm64 job	17m 22s	11m 33s	33.5%
macOS Universal job	27m 36s	1m 12s	95.7%

This is directional rather than a controlled benchmark: the upstream run is a real tag publication and the optimized run is non-publishing validation; runner load, dependency state, and cache warmth may differ. The optimized run still compiled, signed, packaged, staged, uploaded as validation artifacts, and verified Windows, both Linux architectures, both native macOS architectures, and macOS Universal. Upstream-only publication steps after packaging account for roughly one minute of its total runtime, so the main difference is the build critical path.

Production behavior

• tag pushes retain publishing behavior and require a matching v* tag
• workflow_dispatch defaults to publish=false; explicit publishing still requires a matching release tag
• release signing remains enabled and updater signatures remain mandatory
• Windows still produces MSI and NSIS artifacts
• Linux still produces AppImage, DEB, and RPM artifacts for x64 and arm64
• macOS still produces native updater archives plus the Universal DMG
• the complete legacy latest.json, target manifests, SHA256SUMS.txt, and Homebrew cask flow remain in the publishing path

Verification

• actionlint .github/workflows/release.yml
• node --test scripts/release/*.test.cjs (13 passing)
• rustfmt --check src-tauri/build.rs
• successful end-to-end non-publishing release validation: https://github.com/khanra17-org/cockpit-tools/actions/runs/30379835778