fix(ci): bootstrap Sprig rolling release

[BrianInAz]

Summary

• publish sprig-latest through a checked-in create-or-update helper
• create the prerelease with all assets when the tag is absent; retarget metadata and clobber assets when it exists
• fail closed on non-404 API errors, missing artifacts, or release command failures
• add a TDD contract to Ubuntu CI and an as-built repository runbook

TDD and validation

• Red: the contract failed because the source-controlled publisher did not exist
• Green: missing, existing, API-error, and release-error paths pass
• shellcheck and actionlint pass
• full just ci passes under the pinned Hermit toolchain (Node 24.15.0, pnpm 11.4.0)
• Desktop Rust: 2,115 passed, 15 expected ignored, plus 3 diagnostics
• mobile: 1,098 passed, 1 expected skip
• git diff --check, DCO, clean worktree, and changed-diff secret scan pass

Acceptance

Main run 31452775336 proved the current failure is release not found after successful artifact builds. The post-merge Sprig workflow must create sprig-latest without any manual release mutation, then complete successfully.

Beads: ios-buzz-59e.9

Signed-off-by: Brian Charbonneau github@briancharbonneau.com

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.