fix: Package-and-Upload workflow attaches binaries to UI-created releases

[jacalata]

Motivation

Investigating why the v2.0.21 release page shipped with no executables attached, we found two bugs in the Package-and-Upload workflow. v2.0.19 had the same failure mode for the same reason.

Behavior change

Before: the "Upload binaries to release" step was gated on

if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')

Releases created via the GitHub UI create a tag but don't fire the push:tags: event that this workflow depends on. So the workflow only ran manually via workflow_dispatch afterward, built the binaries as workflow artifacts, and skipped the upload-to-release step because the if: guard requires push. The binaries were sitting in the artifact store for 90 days, never on the release.

Separately, both macOS build jobs used name: tabcmd-macos on actions/upload-artifact, so the two same-named artifacts collided in the artifact store and gh run download clobbered one with the other.

After:

• New release_tag workflow_dispatch input. Set it when dispatching from a branch to attach binaries to a UI-created release. Falls back to github.ref_name when the workflow runs on a tag ref (push or dispatch).
• Mac artifact collision fixed: matrix.UPLOAD_FILE_NAME (unique per platform) is now the artifact name instead of tabcmd-${{ matrix.TARGET }}.
• Upload logic split into a new upload_to_release job that depends on buildexe, gated on environment: release. Anyone with dispatch access can trigger a build, but only an approved reviewer can attach binaries to a public release. Mirrors the existing pypi environment gate on this repo (PR security: add environment gate to production PyPI publish job #439).

Prerequisite before merging

The release environment already exists in this repo's Settings -> Environments with required-reviewer protection. Confirm it's still configured before merging; if it isn't, the upload_to_release job will run unguarded.

Test plan

• Live-verified today via gh release upload v2.0.21 ... (with the artifacts downloaded from the last workflow_dispatch run) that the platform binaries were the right ones and could be attached to v2.0.21. The v2.0.21 release page now shows all four assets, retroactively fixed.
• End-to-end verification after merge: for v2.0.22 or a test tag, either push a tag or create a UI release and dispatch the workflow with the release_tag input; confirm the approval gate fires and the four binaries end up on the release page.
• Code review from code-reviewer agent — no blocking findings; added inline comments for the upload-artifact@v7 / download-artifact@v8 major mismatch (both are current best; upload@v8 doesn't exist yet) and the needs: buildexe all-matrix-legs-must-succeed semantics.

🤖 Generated with Claude Code

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
tabcmd
__main__.py	12	12	12	0%
_version.py	11	11	11	0%
tabcmd.py	15	15	15	0%
version.py	9	5	5	44%
tabcmd/commands
commands.py	10	10	10	0%
constants.py	77	18	18	77%
server.py	135	18	18	87%
tabcmd/commands/auth
session.py	394	50	50	87%
tabcmd/commands/datasources_and_workbooks
datasources_and_workbooks_command.py	157	18	18	89%
datasources_workbooks_views_url_parser.py	142	5	5	96%
delete_command.py	60	16	16	73%
export_command.py	120	25	25	79%
get_url_command.py	127	47	47	63%
publish_command.py	123	28	28	77%
runschedule_command.py	21	7	7	67%
tabcmd/commands/extracts
create_extracts_command.py	42	8	8	81%
decrypt_extracts_command.py	27	2	2	93%
delete_extracts_command.py	37	6	6	84%
encrypt_extracts_command.py	27	2	2	93%
extracts.py	20	2	2	90%
reencrypt_extracts_command.py	27	2	2	93%
refresh_extracts_command.py	48	10	10	79%
tabcmd/commands/group
create_group_command.py	29	5	5	83%
delete_group_command.py	27	2	2	93%
tabcmd/commands/project
create_project_command.py	46	8	8	83%
delete_project_command.py	35	4	4	89%
publish_samples_command.py	30	4	4	87%
tabcmd/commands/site
create_site_command.py	34	5	5	85%
delete_site_command.py	27	2	2	93%
edit_site_command.py	38	2	2	95%
list_command.py	77	12	12	84%
list_sites_command.py	29	2	2	93%
tabcmd/commands/user
add_users_command.py	29	5	5	83%
create_site_users.py	58	11	11	81%
create_users_command.py	59	9	9	85%
delete_site_users_command.py	43	5	5	88%
user_data.py	222	31	31	86%
tabcmd/execution
_version.py	2	2	2	0%
global_options.py	125	8	8	94%
localize.py	66	11	11	83%
logger_config.py	60	6	6	90%
tabcmd_controller.py	42	7	7	83%
TOTAL	2873	458	84%