fix(release): preserve alpha-tested promotion payload #897

Acceptance Criteria

• Candidate preparation performs a read-only fork credential preflight and reports rotation or SSO remediation on failure.
• Candidate preparation creates and verifies the BETA fork release before an alpha tag is cut.
• The alpha's committed release pin identifies the exact fork tag, commit, and platform hashes that stable promotion uses.
• Promotion rebuilds only from the alpha tag's immutable release pin and makes no cross-repository calls.
• Promotion packages and publishes all Marketplace targets in one job without an Actions artifact handoff.
• Retrying a partially failed release is idempotent: it rebuilds from the same tag, refreshes release assets safely, and skips Marketplace targets already published.
• v0.3.3 remains a GitHub direct-install recovery release; the first Marketplace release under this contract is v0.3.4.
• The real v0.3.4-alpha.1 flow proves candidate provisioning and validates the same BETA payload that reaches Marketplace.

Testing Decisions

• Add deterministic workflow/helper tests for credential preflight, immutable-pin selection, and retry classification.
• Run the extension package, contract parity, authenticated boot smoke, and migration-upgrade proof against the candidate payload.
• Exercise the cross-repository path through the real v0.3.4-alpha.1 candidate, then confirm promotion performs no fork provisioning.

Key Decisions

• The fine-grained PAT is used only by candidate preparation; stable promotion has no cross-repository authority.
• An alpha may carry the BETA binary that stable will ship, because alpha is the payload-validation surface.
• A stable release rebuilds from its tag rather than artifact storage, but its tag pin is immutable and complete.
• Marketplace publication is in the packaging job so release assets and publish attempts share one payload without artifact-service coupling.

Constraints & Invariants

• A Marketplace executable must be semantically identical to the payload tested in alpha.
• A clean tag must remain recoverable after partial GitHub Release or Marketplace failure.
• Release recovery must never reuse or retarget a published version.
• Cross-repository credential failures must happen before any fork tag or dispatch write.

Prior Art

• Existing alpha and promote workflows.
• The fork binary release workflow.
• The v0.3.3 failed provisioning and artifact-upload runs.

Notes

• v0.3.3-alpha.1 and its direct stable GitHub Release both validated the guarded amicode.19 migration repair. Marketplace publication did not start.