Changes touching this path

• publish-r2: mirror release artifacts to Cloudflare R2 for anonymous download (#807) The repo is private permanently (ADR 0045), so Release assets 404 for an unauthenticated fetch — which is what broke `curl | sh`. This adds the anonymous path that replaces them: every asset the Release publishes is mirrored to dl.millerbyte.com/<tag>/, served from R2 with no credentials. The bucket, its scoped credential and the dl.millerbyte.com custom domain are provisioned by scripts/setup-artifacts.js (scripts @ 736f6e8), and the anonymous fetch is already proven live against that bucket. A *publish* job, not post-announce, and the ordering is load-bearing: publish jobs run after `host` uploads the Release and `announce` waits for them, so R2 is populated before the post-announce smoke test. Listed post-announce instead, #808's `curl | sh` gate would race the very artifacts it fetches. The job body is hand-owned in its own file so `dist generate` cannot clobber it — the same shape as smoke-install.yml (#258). It carries a workflow_dispatch tag input so it can be exercised against an existing release rather than first running during a real one, verifies every mirrored asset anonymously against the Release's own sha256, and warns (not fails) if the edge is not caching. ⚠ dist-workspace.toml also documents that it must be edited with `dist generate`, never `dist init` — init rewrites the config from its own defaults and strips every comment, which today destroyed the #270 native-ARM64-runner rationale and the whole ADR 0045 attestations block before they were restored. 5b710e89 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.