ci(release): allow release publishers to be dispatched individually (#4987)

* ci(release): allow release publishers to be dispatched individually

Move the TypeScript SDK and wheel publishers into reusable workflows and add
workflow_dispatch to them and to snap-publish.yml, following sync-docs.yml.
Release still calls each one. A maintainer can now publish one missing
component for an existing release without rebuilding or rerunning Release.

The snap publisher can upload artifacts from an earlier run, and a manual
latest/stable upload requires a release tag so it still rechecks the newest
stable release.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(release): allow the Go SDK tag to be dispatched individually

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(release): verify dispatched snap and wheel inputs match the release

A dispatched snap upload checks that its artifacts were built for the
release tag. A wheel publish first confirms the tag points to the given
commit and that each wheel is attached to that release at the given
version. artifact-run-id is declared on workflow_call so callers do not
rely on an undeclared input.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(release): verify the provenance of dispatched snap artifacts

A manual snap upload now requires artifact-run-id to be this repository's
publishing workflow for the channel, and stable snaps must match the GitHub
Release asset digests. A skipped stable upload now reports a notice.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* Revert "ci(release): verify the provenance of dispatched snap artifacts"

This reverts commit 8bcf1e1e73.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

---------

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

.github/workflows/release-dev.yml

@@ -265,12 +265,15 @@ jobs:
   publish-snap:
     name: Publish snap
     needs: build-snap
+    permissions:
+      actions: read
+      contents: read
     uses: ./.github/workflows/snap-publish.yml
     with:
       upload-channel: latest/edge
       github-environment: latest/edge
     secrets:
-      publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
 
   # ---------------------------------------------------------------------------
   # Create / update the dev GitHub Release with CLI, gateway, driver, and wheels