Mirror Rust release artifacts to Cloudflare R2 (#34505)

## What changed

- Add a reusable workflow that runs after the GitHub Release and DotSlash publishing jobs and mirrors each release asset to a versioned R2 prefix.
- Validate GitHub asset sizes and SHA-256 digests before upload, publish objects without overwriting existing files, and verify their remote size, digest metadata, and CRC64 checksum.
- Generate `release.json` with installer-facing asset URLs and digests, then publish and verify it alongside the release assets.
- Allow an in-progress Rust release workflow to finish instead of cancelling it when another run starts.

GitOrigin-RevId: e6717cd27914994accced6e2c5df696f0e9a558e

.github/workflows/r2-release.yml

@@ -0,0 +1,38 @@
+name: publish-r2-release
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: codex-r2-publisher
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Publish release assets and metadata to R2
+        # R2 exposes an S3-compatible API, so the AWS CLI reads AWS-named variables.
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CODEX_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CODEX_R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: ${{ vars.CODEX_R2_ENDPOINT_URL }}
+          AWS_REGION: ${{ vars.CODEX_R2_REGION }}
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          python3 .github/scripts/publish_r2_release.py \
+            --tag "${RELEASE_TAG}"

.github/workflows/rust-release.yml

@@ -19,7 +19,7 @@ env:
 
 concurrency:
   group: ${{ github.workflow }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
   tag-check:
@@ -1273,6 +1273,16 @@ jobs:
           # (e.g. -alpha, -beta). Otherwise publish a normal release.
           prerelease: ${{ contains(steps.release_name.outputs.name, '-') }}
 
+  publish-r2:
+    name: publish-r2
+    needs: [release, publish-dotslash]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/r2-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+
   publish-dotslash:
     name: publish-dotslash
     needs: release