Publish release metadata to R2 channels (#34508)

## What changed

- Publish the verified `release.json` metadata to `codex/channels/latest` for
  stable releases and `codex/channels/prerelease` for prereleases.
- Pass the release classification through the reusable R2 workflow so GitHub
  Releases and R2 channels use the same stable-versus-prerelease decision.
- Allow channel objects to be replaced while keeping versioned release objects
  immutable, and verify each channel upload before completing the publication.

GitOrigin-RevId: bd5c728c5565befe42b041ee1a032b111daca1c2

.github/workflows/r2-release.yml

@@ -6,6 +6,12 @@ on:
       tag:
         required: true
         type: string
+      make_latest:
+        required: true
+        type: boolean
+      prerelease:
+        required: true
+        type: boolean
 
 permissions: {}
 
@@ -32,7 +38,11 @@ jobs:
           AWS_REGION: ${{ vars.CODEX_R2_REGION }}
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag }}
+          RELEASE_MAKE_LATEST: ${{ inputs.make_latest }}
+          RELEASE_PRERELEASE: ${{ inputs.prerelease }}
         run: |
           set -euo pipefail
           python3 .github/scripts/publish_r2_release.py \
-            --tag "${RELEASE_TAG}"
+            --tag "${RELEASE_TAG}" \
+            --make-latest "${RELEASE_MAKE_LATEST}" \
+            --prerelease "${RELEASE_PRERELEASE}"

.github/workflows/rust-release.yml

@@ -1130,6 +1130,8 @@ jobs:
     outputs:
       version: ${{ steps.release_name.outputs.name }}
       tag: ${{ github.ref_name }}
+      make_latest: ${{ steps.release_name.outputs.make_latest }}
+      prerelease: ${{ steps.release_name.outputs.prerelease }}
       should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }}
       npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }}
 
@@ -1208,6 +1210,13 @@ jobs:
           # "rust-v0.1.0".
           version="${GITHUB_REF_NAME#rust-v}"
           echo "name=${version}" >> $GITHUB_OUTPUT
+          if [[ "${version}" == *-* ]]; then
+            echo "make_latest=false" >> $GITHUB_OUTPUT
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "make_latest=true" >> $GITHUB_OUTPUT
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Determine npm publish settings
         id: npm_publish_settings
@@ -1268,10 +1277,10 @@ jobs:
           body_path: ${{ steps.release_notes.outputs.path }}
           files: dist/**
           overwrite_files: true
-          make_latest: ${{ !contains(steps.release_name.outputs.name, '-') }}
+          make_latest: ${{ steps.release_name.outputs.make_latest }}
           # Mark as prerelease only when the version has a suffix after x.y.z
           # (e.g. -alpha, -beta). Otherwise publish a normal release.
-          prerelease: ${{ contains(steps.release_name.outputs.name, '-') }}
+          prerelease: ${{ steps.release_name.outputs.prerelease }}
 
   publish-r2:
     name: publish-r2
@@ -1282,6 +1291,8 @@ jobs:
     secrets: inherit
     with:
       tag: ${{ needs.release.outputs.tag }}
+      make_latest: ${{ fromJSON(needs.release.outputs.make_latest) }}
+      prerelease: ${{ fromJSON(needs.release.outputs.prerelease) }}
 
   publish-dotslash:
     name: publish-dotslash