ci: sdk-tag never replaces a released SDK tarball

[foxnne]

What changes

A merge to main that touches sdk/** without bumping sdk_version no longer repacks and replaces the latest SDK release's tarball.

Until now, every push touching sdk/** ran the pack and publish steps even when the version's tag already existed, and the publish step uploaded with --clobber. The released fizzy-sdk-v<version>.tar.gz was replaced by main's later sdk/. Plugins pin that asset by hash, so a replaced one fails every clean fetch.

It has already happened: sdk-v0.2.15 shipped on 10-02 (edb77afd). Its tarball was then repacked from #207's merge on 10-04 (run 37163565097 logs Release sdk-v0.2.15 exists — uploading/replacing asset, and the asset's createdAt is that run's). The store plugins have since moved to 0.2.16/0.2.17, so nothing should be fetching it now. sdk-v0.2.16 and sdk-v0.2.17 are intact: nothing has touched sdk/ since either shipped.

Now:

• The tag step reports whether to publish. It publishes for a tag it just created. It also publishes for an existing tag whose release has no tarball (a run that failed after pushing the tag), and packs that one from the tag's own commit, not from main.
• An existing tag that already has its tarball publishes nothing.
• The upload no longer clobbers. If gh ever misreports a tarball as missing, the run fails instead of replacing it.

This needs to land before #230's release train. Under the train every SDK feature PR touches sdk/** without a version bump, so each one would have repacked the latest release.

SDK impact

• None. Workflow only; no sdk/ file changes.

Verified

• The tag step's script, run locally against a repo with an existing tag and a stubbed gh, behaves as intended in three cases:
  • asset present: publish=false, HEAD unchanged
  • asset missing: publish=true, tag checked out
  • gh erroring: publish=true from the tag, and the non-clobbering upload would then fail if the asset exists
• The workflow parses; the three publish steps are gated on steps.tag.outputs.publish.
• Not exercised on GitHub. It runs only on push to main; the first sdk/** merge after this one is the live test (expect "nothing to publish").

Follow-ups

• Whether to restore sdk-v0.2.15's original tarball is your call. Its original hash is fizzy-0.2.15-SGBwY-gGGwAbpDp0riHXnY2CnhgJGPS51MxM5vLoVhiw, and it can probably be rebuilt by packing edb77afd's tree with that commit's own scripts/pack-sdk.sh on Linux, as CI did. Today's script writes .paths differently, so it may not match. zig fetch the result to check the hash before uploading.

🤖 Generated with Claude Code