Rebuild release publishing (#492)

* ci: rebuild tag-based publishing

* ci: prevent stable alias rollbacks

* ci: make tagged artifacts immutable

* ci: publish releases atomically

* ci: smoke-test both container architectures

* ci: disable Rust caches for publishing

* ci: preserve unmanaged release assets

* ci: label reduced-feature release binaries

* ci: record the release source branch

* ci: avoid retargeting the dev release

* ci: verify containers before tagging

Author: sjtrny