[zeth]

Publishing Python packages currently rebuilds distributions after candidate validation. Add release.py publish-python --record ... --package kit|python --destination pypi|testpypi to publish the exact files recorded by candidate preparation and retain completion separately for each package and destination.

The command requires an existing matching release tag at the candidate SHA and records the prepared package evidence in an immutable metadata commit. It dispatches the existing package workflows on that tag with the metadata path/ref. Their new prepared path skips SDK/distribution builds, downloads the original artifact IDs, verifies run/source/attempt identity and ZIP hashes, then repeats package metadata, file-hash and Kit SDK checks. Existing workflow filenames, publisher environments, manual build-and-publish paths and preview rules remain in use.

Before uploading, compare the destination index against the expected filenames, sizes and SHA256 values. Upload only missing files; reject conflicts, unexpected/duplicate files and yanked files. Verify the complete index after uploading and retain a publication receipt with original source/run/artifact identities and all file hashes. The coordinator checks the receipt and independently checks the index before saving completion. Interrupted dispatches reconcile without duplicate publishing runs; failed-job retries can complete partial uploads without rebuilding successful siblings. Completed destinations remain verifiable after CI artifacts expire. Unpublished/partial destinations still require the exact retained bytes; the runbook documents expiry and manual recovery limits.

Update the runbook and add the Python publication guide, including the existing tag-to-Launchpad boundary. The command does not create release tags. No actual Release/staging/publishing dispatches, tags or uploads were performed while developing this PR. Validate the full remote handoff through the next actual release; no separate rehearsal or TestPyPI upload is required.

Validation: 94 release tests and 41 staging tests pass. New tests cover original-byte fetching without builds, correct source/tag/ref/path requirements, annotated tags, independent destinations, uncertain dispatch reconciliation, failed-run retry, receipt/index conflicts, empty/partial/complete index plans, changed local bytes, bounded index availability waits and completion after artifact expiry. Preparation fixtures now freeze their clocks and root version so their artificial expiry/version inputs remain deterministic. Boundary, version, workflow YAML and diff checks pass. The default build paths will also run in normal PR CI.

Continues #120 and #122. Desktop/core promotion, signing handoffs, Launchpad binary availability and final website completion remain later coordinator slices.