fix(release): close out exact published retries

[jeremi]

What changed

• classify a pre-existing release destination as absent, exact draft, or exact published
• route an exact published retry through the read-only public verifier
• skip draft, image, asset, npm, and PyPI mutation jobs once the exact release is public
• allow authenticated docs promotion after successful public closeout

Why

A fresh protected-main retry failed after a release had already become public, even when the tag, title, candidate marker, assets, signatures, images, and package registries were exact. This contradicted the documented recovery contract and could force an unsupported manual closeout path.

Safety

The published path is accepted only when the release has the exact tag, title, non-prerelease state, publication timestamp, and candidate-manifest marker. It then runs registry-release verify-public, which checks the immutable asset, checksum, Sigstore, OCI, client-registry, and binary-smoke closure before docs redispatch.

Checks

• python3 -m unittest release/scripts/test_release_workflow_structure.py release/scripts/test_registry_release.py release/scripts/test_release_candidate.py release/scripts/test_verify_public_release.py (130 passed)
• actionlint .github/workflows/release.yml
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9c901295c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Classify published releases before candidate expiry checks

For a fresh retry after the candidate's seven-day validity window, this new classification is never reached: the preceding artifact download requires an unexpired private artifact, and verify-candidate --promotion rejects the expired manifest at release/scripts/release_candidate.py:999. Consequently destination_state is never emitted, closeout-published is skipped, and an otherwise exact latest public release cannot be verified or have its failed docs dispatch recovered. Determine and bind the published state before the private-candidate lifetime checks, then let the read-only verify-public path establish the immutable public contract without requiring a still-live candidate.

Useful? React with 👍 / 👎.