feat(releaser): harden and serialize release publication

[martinothamar-agent]

Description

Stacked on #19809, which introduces Git-history release detection and carries an immutable release plan into the reusable publishers. This follow-up hardens publication after that plan has been selected.

Make component publication recoverable, centrally governed, and serialized without weakening the immutable release plan:

• require manual recovery to select the canonical branch and provide the exact released version and full commit SHA
• verify that the selected changelog version exists at that exact commit and reject symbolic or abbreviated commit inputs
• resume only an existing draft release whose target matches the pinned commit; reject published releases and drafts targeting another commit
• update release metadata and replace matching assets so a failed upload can be retried
• rely on NuGet's existing --skip-duplicate behavior when package publication was only partially completed
• immediately before creating or updating a release, resolve the remote tag (including annotated tags) and require it to be absent or target the pinned commit
• centralize each component's publisher and release-environment mapping in the typed registry
• map preview, release-candidate, and stable releases to dev, staging, and production through one fail-closed policy
• protect the component registry and release-policy implementation with CODEOWNERS
• serialize publication by publisher and base branch using a bounded FIFO queue without cancelling an in-flight or already queued release

Together, these changes keep recovery on the failed run's exact plan, remove duplicated workflow policy, and prevent overlapping publications from racing.

Verification

• Related issues are connected (stacked on ci(releaser): automate component releases from Git history #19809)
• Your code builds clean without any errors or warnings
• Manual testing done (required)
• Relevant automated test added (if you find this hard, leave it and we'll help out)

$ make fmt && make lint && make test && make test-e2e && make build
# exit 0; 0 lint issues; unit and e2e tests pass with -race

$ actionlint -ignore 'unexpected key "queue"' \
    .github/workflows/release-components.yaml \
    .github/workflows/release-app.yaml \
    .github/workflows/release-studioctl.yaml \
    .github/workflows/cli-build-test.yaml
# exit 0; the narrow ignore covers queue syntax newer than actionlint 1.7.12

$ npm run codeowners:validate
# exit 0

$ git diff --check origin/main...HEAD
# exit 0

Manual recovery checks accepted a real historical studioctl promotion when given its full commit SHA and exact version, and rejected the same request with an abbreviated SHA. A full detached-HEAD studioctl dry run built all 15 artifacts and targeted the pinned commit without creating tags, releases, or packages.

Independent review covered recovery/idempotency, exact tag targeting, policy ownership, and concurrency semantics. Its actionable findings—strict full-SHA validation, remote tag revalidation, complete CODEOWNERS coverage, and retaining queued publications—are included here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4db3ce9e-ff38-4556-94b1-ccb76e0121b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}