ci(release): package the extension from scripts/build-release.sh

[Naruto]

The same move as SpriteStudio-SDK #361 and SSPlayerForUnity #101.

release.yml drops from 324 lines to 308, and from 100 lines of inline shell to 53. What is left is the signing keychain and the Apple API key — they handle secrets and are genuinely GitHub's. The package job has 3 lines, the non-tag guard.

The check is why this was worth doing

misc/spritestudio.gdextension names a file per platform and build target — nineteen paths — plus three icons, and Godot resolves them at load time.

A name that does not match what actually shipped fails no build and no zip. The extension simply does not load, on that one platform, for whoever downloaded it. Nothing in this pipeline compared the two.

Every path in the descriptor is now looked up inside the finished archive. Dropping one Android .so from a test build is caught:

spritestudio.gdextension names bin/android/libSSGodot.android.template_debug.arm64.so,
which is not in ssplayer-godot-extension-4.7.zip

It does not build

Six platforms need Linux, Windows and macOS between them, so there is no local equivalent of the matrix. This is the phase after it is settled what is being released — the tag comes from the checkout, the binaries from whatever populated in= — so it takes no option that re-decides either:

gh run download <run-id> -D artifacts
scripts/build-release.sh

Aligned with the family

• upload_release=true from a non-tag ref fails instead of silently skipping the Release, which is what if: startsWith(github.ref, …) used to do. A dispatch meant to cut a release should not report success and produce none.
• SHA256SUMS is written by the script.
• Workflow artifacts expire after a week. What is meant to last is attached to the Release, which never expires, and a full org storage quota fails the build in a step unrelated to it.

No commit hash in artifact names

They are consumed by the package job in the same run, where the platform already makes them unique — and a name the packaging step has to be told the hash of is a name it cannot resolve on its own. That took pr-mpt/actions-commit-hash out of both jobs.

release-gdextension-windows.ps1 now drops its own .exp / .lib link residue instead of release.yml doing it afterwards, so bin/windows looks the same locally as it does in a release.

Verification

The old workflow's packaging shell (45 lines) was extracted from git and run over the same fixture as the new script:

	result
zip entries	identical (46)
extracted contents	identical

The .ps1 twin was run on pwsh 7.6.5 and produces identical extracted contents and SHA256SUMS formatting. (The archive hash itself differs between runs — zip stores per-file mtimes.)

Not yet verified in CI

This repository has no release runs at all, so the workflow has never been exercised. After merging, dispatch once with upload_release=false and check the ssplayer-godot-release-dist-4.7 artifact.