Parallelize release builds - #1930

Background: We publish the CLI for five OS/arch combinations: Mac (x86, ARM), Windows (just x86) and Linux (x86, ARM).

Problem: The MacOS runner builds two binaries in serial (x86, then ARM). The Ubuntu runner builds three binaries in serial (Windows x86, Linux x86, Linux ARM). This is fine, but slow. It'd be faster to parallelize across 5 runners, one per job. That's how the check-release CI job works, we should make the real release work the same way.

Solution: Prepare Cargo sources, the Linux cross executable, version, and prerelease status once, then run one shard per target. So, there's a shared initial "prepare" step, then shard across the five targets, then come back together to verify/document/publish them.

prepare
  ├─ macOS x86-64
  ├─ macOS ARM64
  ├─ Windows GNU
  ├─ Linux x86-64 musl
  └─ Linux ARM64 musl
       ↓ all five finish
  verify assets + combine instructions → publish → Homebrew

Share preparation with PR CI through a composite action. Reuse PR build caches, scoped by host OS/architecture, target, Rust compiler, and lockfile. Collect artifacts before one upload; preserve binary names, checksum files, and download URLs. Homebrew uses the prepared version without installing Cargo tools or compiler packages.

Testing

• Before: The successful release spends 23m17s building three Linux/Windows targets serially and 16m38s on two macOS targets. Homebrew's dependency installation takes 46m57s.
• After: A release dry run passes all five target builds in parallel (3m7s–4m7s), following 27s of shared preparation. Sources, the cross executable, and all five compiled build caches restore successfully. These are warm-cache timings, not a controlled speedup benchmark.
• Artifact collection downloads all five artifacts and verifies both checksums for every binary before assembling the combined instructions and download directory.
• Homebrew packaging passes in 20s without dependency installation, using the existing published binaries. Publishing, cloud authentication, and Homebrew repository updates were disabled in this dry run.
• Local checks cover stable/rc/pre version outputs, the 15 release assets plus combined README, and missing/corrupted artifacts failing before publication. Workflow lint and Bash syntax checks pass.
• Temporary validation wiring has been removed. Existing required PR check names are unchanged.

Merge Danger

Door: Two-way

Blast Radius: Releases

Changes release scheduling, artifact collection, and publishing dependencies. Publishing waits for every target and checksum verification. No new tag or release was published during validation.