Description of Changes

Adds a final publish-github-release job to the manual release workflow. On non-dry-run releases, it waits for all release jobs to finish successfully or be skipped, then calls cargo-release release github-release.

The new release-tool target verifies the target GitHub release is still a draft, dispatches attach-artifacts.yml using the workflow URL returned by gh workflow run, waits for that artifact workflow to complete, and then publishes the release. If the release is already published, the command exits successfully without re-uploading artifacts.

API and ABI breaking changes

None.

Expected complexity level and risk

2. Workflow-only release behavior plus a new cargo-release target. The risky part is release sequencing, so the workflow keeps explicit needs checks and the publish logic fails before publication if artifact attachment does not succeed.

Testing

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml")'
• git diff --check
• PATH=/Users/clockworklabs/.rustup/toolchains/1.93.0-aarch64-apple-darwin/bin:$PATH cargo check --manifest-path tools/release/Cargo.toml
• PATH=/Users/clockworklabs/.rustup/toolchains/1.93.0-aarch64-apple-darwin/bin:$PATH cargo run --manifest-path tools/release/Cargo.toml -- release github-release --help
• actionlint .github/workflows/release.yml was not run because actionlint is not installed locally.