[zeth]

Core SDK publication is still a separate dispatch, and the shared snapshot publisher deletes unfinished drafts and returns immediately for an existing published tag. Add release.py publish-sdk --record ... --wait to publish the candidate's existing three Release SDK archives with verified reuse and per-destination completion evidence.

Retain the selected Daemon run/attempt, immutable artifact IDs/digests, core selection and per-platform producer identities in an SDK input metadata commit. Dispatch the existing workflow on main with that immutable reference. Its common manual/coordinated fetch path checks the existing Holder source tag and root version, successful source run, pins/ZIP hashes, archive hashes/sizes, cached producer core-tree/version identity, and internal SDK manifests through the production indexer. Exactly Linux/Windows x86_64 and macOS arm64 Release SDKs are accepted. No SDK is rebuilt or executed during publication.

The release publisher verifies/resumes the SDK draft, uploads only missing files, preserves matching assets and notes, and publishes only after all three archives and the compatible schema-1 index match. It rejects conflicting/unexpected/incomplete published sets; it never deletes a draft or replaces an existing asset. A matching legacy index is checked as JSON and retained with its actual bytes/hash. Source-tag identity is checked before each write. Already-complete published releases are read-only. Keep the existing stable/prerelease/latest policy and SDK-repository tag target behavior, while recording that target separately from the Holder candidate and cached SDK producer commits.

Persist the workflow input/publication receipts and independently verify destination release/asset IDs, hashes, index and SDK tag target in the coordinator. Support uncertain-dispatch reconciliation, failed-job retries, partial uploads, publication-response/cleanup failures, and completion recognition after source artifact expiry without another publishing run. SDK input or accepted destination drift stops the operation. Update the runbook and add the SDK publication/recovery guide.

Extract the release/asset primitives shared with Linux promotion into github-release.py; all existing Linux promotion tests still pass. Core CI's development-snapshot publisher, including its Ubuntu package payload, is unchanged. The SDK workflow retains its existing publishing environment and publisher configuration; live inspection confirms its branch policy remains in place and no reviewer gate is configured.

Validation: 141 release tests and 41 staging tests pass. SDK coverage includes real tar/ZIP manifest indexing, producer/candidate/tag separation, profile/manifest/source-tree/version rejection, source attempt/pin drift, partial draft reuse, response loss, conflicts, legacy index formatting, independent completion/expiry, accepted ID/tag/hash drift and CLI resume. Boundary, root version, YAML and diff checks pass. Read-only live inspection found no published holder-v* SDK releases yet, and verified the existing public 0.2.6 development index's schema/fields without downloading SDK archives. No actual release/build/publishing dispatch, SDK draft/tag creation or upload was performed; validate the protected stable SDK path through the next actual release using this tooling.

Continues #120 and #122. Remaining platform delivery, Launchpad binary availability and website completion remain subsequent work.