Address post-merge review feedback on immutable per-arch tags

[fnando]

Follow-up to @leighmcculloch's review comments left on #41 after it merged.

• backfill: guard against mislabeling a partial publish. If the newest v<cli>[-N] release failed before pushing images, the live per-arch tags still hold an earlier iteration's content. Adds an --iteration override, a warning when auto-resolving, and makes the "already exists" path fail loudly on a digest mismatch instead of silently skipping.
• publish.yml: fix a comment referencing a non-existent :<version>-<N> tag "published by the aliases job" — the tags are :<cli>-rust<key>-<arch>-<N>, minted by the manifest job.
• docs: the repo auto-deletes branches on merge, so the release-branch guard covers prepare → merge, not "across the merge → publish gap". Also clarify restarts: immutable snapshots never move, so re-running build produces a new digest and the manifest job refuses to re-point — cut a new iteration instead.

Tests: uv run pytest (230 passed), ruff check and ruff format --check clean.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds safer and more controllable backfilling of immutable per-arch Docker snapshot tags by supporting an explicit iteration override and refusing to repoint existing immutable tags.

Changes:

• Add --iteration option and centralize iteration resolution with a prominent operator warning.
• Refuse to repoint an existing immutable snapshot tag if it already exists with a different digest (immutability guard).
• Expand unit tests and update release/publish documentation to reflect the new behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/unit/test_backfill_iteration_tags.py	Adds coverage for explicit iteration, negative iteration rejection, and immutability conflict behavior.
scripts/lib/gh_cli.py	Updates docstring to clarify how release branch tags prevent iteration reuse during review.
scripts/backfill_iteration_tags.py	Implements --iteration, iteration resolution/warning, and digest-match vs repoint-fail logic.
RELEASE.md	Documents immutability guarantees and rerun behavior, including why rebuilds can’t repoint published snapshots.
.github/workflows/publish.yml	Updates comments to match current tag/manifest job behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.