ci(release): mirror latest release to R2

[uvwt]

Summary

• mirror the validated, published AgentDock Release to Cloudflare R2 after GitHub Release publication
• publish a GitHub-compatible latest.json manifest for future installer/self-update migration
• verify public versioned assets before switching the latest manifest
• remove stale R2 release objects after the new latest manifest is live
• keep GitHub Releases as the immutable historical archive

R2 layout

• latest.json
• releases/<tag>/<release assets>

The R2 mirror retains only the current stable release. Historical versions remain on GitHub Releases.

Verification

• go test ./...
• actionlint .github/workflows/*.yml
• git diff --check
• mirror manifest smoke test against the release catalog

Repository configuration

Variables already configured:

• R2_ACCOUNT_ID
• R2_BUCKET=nexusdock-prod-downloads
• R2_PUBLIC_BASE_URL=https://download.nexusdock.co

The bucket and download.nexusdock.co custom domain are already provisioned. The remaining deployment prerequisite is a bucket-scoped Cloudflare R2 Object Read & Write credential stored as:

• R2_ACCESS_KEY_ID
• R2_SECRET_ACCESS_KEY