Parallelize R2 asset publishing with DotSlash (#36871)

## Why

R2 publication waited for DotSlash to finish before uploading any release
assets, extending the release pipeline's critical path.

## What changed

- Start an `assets` stage after the GitHub release is created, in parallel with
  DotSlash publication. Upload available assets concurrently without publishing
  release metadata or channel aliases.
- Run a `finalize` stage after both jobs complete. Verify assets already present
  in R2, upload any assets DotSlash added, and then publish metadata, stable
  installer aliases, and release channels.
- Validate downloaded assets before upload and retain no-overwrite semantics
  across both stages.

GitOrigin-RevId: 1c3e8ca715be4064c2532a5c651f1bbe03ed96a4

.github/workflows/r2-release.yml

@@ -12,6 +12,9 @@ on:
       prerelease:
         required: true
         type: boolean
+      stage:
+        required: true
+        type: string
 
 permissions: {}
 
@@ -40,9 +43,11 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
           RELEASE_MAKE_LATEST: ${{ inputs.make_latest }}
           RELEASE_PRERELEASE: ${{ inputs.prerelease }}
+          RELEASE_STAGE: ${{ inputs.stage }}
         run: |
           set -euo pipefail
           python3 .github/scripts/publish_r2_release.py \
             --tag "${RELEASE_TAG}" \
             --make-latest "${RELEASE_MAKE_LATEST}" \
-            --prerelease "${RELEASE_PRERELEASE}"
+            --prerelease "${RELEASE_PRERELEASE}" \
+            --stage "${RELEASE_STAGE}"

.github/workflows/rust-release.yml

@@ -1356,9 +1356,9 @@ jobs:
           # (e.g. -alpha, -beta). Otherwise publish a normal release.
           prerelease: ${{ steps.release_name.outputs.prerelease }}
 
-  publish-r2:
-    name: publish-r2
-    needs: [release, publish-dotslash]
+  publish-r2-assets:
+    name: publish-r2-assets
+    needs: release
     permissions:
       contents: read
     uses: ./.github/workflows/r2-release.yml
@@ -1367,6 +1367,20 @@ jobs:
       tag: ${{ needs.release.outputs.tag }}
       make_latest: ${{ fromJSON(needs.release.outputs.make_latest) }}
       prerelease: ${{ fromJSON(needs.release.outputs.prerelease) }}
+      stage: assets
+
+  publish-r2:
+    name: publish-r2
+    needs: [release, publish-dotslash, publish-r2-assets]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/r2-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+      make_latest: ${{ fromJSON(needs.release.outputs.make_latest) }}
+      prerelease: ${{ fromJSON(needs.release.outputs.prerelease) }}
+      stage: finalize
 
   publish-dotslash:
     name: publish-dotslash