Retry flaky baseline builds, and never lose a platform to one

The windows-x64 job died on "Failed to extract executable for
bun-windows-x64-baseline-v1.3.14. The download may be incomplete." Building the
no-AVX2 variant makes Bun fetch extra cross-compilation artifacts, and that
fetch is known-flaky — opencode's own build script calls it out.

The build now retries three times, and if the baseline variant still will not
download, falls back to building the native binary alone rather than failing
the platform outright. The installer only requests -baseline on non-AVX2 x64
hardware; everyone else is served by the native asset, so a missing baseline
should degrade coverage, not erase the platform.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Rick Valdes

.github/workflows/utmstack-release.yml

@@ -67,12 +67,33 @@ jobs:
         env:
           OPENCODE_VERSION: ${{ steps.version.outputs.value }}
         run: |
-          # --baseline additionally emits the no-AVX2 variant for x64 targets.
-          if [ "${{ matrix.baseline }}" = "true" ]; then
-            bun run script/build.ts --single --baseline
-          else
-            bun run script/build.ts --single
+          # --baseline additionally emits the no-AVX2 variant for x64 targets,
+          # which requires Bun to fetch extra cross-compilation artifacts. That
+          # download is known to be flaky ("Failed to extract executable for
+          # bun-<target>-baseline"), so retry before giving up.
+          build() {
+            if [ "${{ matrix.baseline }}" = "true" ]; then
+              bun run script/build.ts --single --baseline
+            else
+              bun run script/build.ts --single
+            fi
+          }
+          ok=0
+          for attempt in 1 2 3; do
+            echo "build attempt $attempt"
+            if build; then ok=1; break; fi
+            echo "attempt $attempt failed; retrying in 15s"
+            sleep 15
+          done
+          if [ "$ok" != "1" ] && [ "${{ matrix.baseline }}" = "true" ]; then
+            # A flaky baseline artifact must not cost us the primary binary for
+            # this platform. Fall back to the native build alone; the installer
+            # only requests -baseline on non-AVX2 x64 hardware, and the native
+            # asset still serves everyone else.
+            echo "baseline builds failed 3x — falling back to the native build only"
+            bun run script/build.ts --single && ok=1
           fi
+          [ "$ok" = "1" ] || { echo "build failed after retries"; exit 1; }
           ls -la dist/
 
       - name: Verify the binary is branded and self-contained