feat(release): auto-publish cli builds to cloudflare r2

Wire release.yml to call publish-r2.yml after a successful tag or
dispatch release. Upload archives, checksums, release JSON, and
checksum-verifying installers to software.cortex.foundation. Teach
cortex upgrade to parse the static R2 manifest layout.

Co-authored-by: Mathis <echobt@users.noreply.github.com>

Author: cursoragent

.github/workflows/publish-r2.yml

@@ -374,4 +374,24 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  # ==========================================================================
+  # Publish binaries to software.cortex.foundation (Cloudflare R2)
+  # ==========================================================================
+  publish:
+    name: Publish to software.cortex.foundation
+    needs: [prepare, release]
+    if: success() && needs.release.result == 'success'
+    uses: ./.github/workflows/publish-r2.yml
+    with:
+      version: ${{ needs.prepare.outputs.version }}
+      channel: ${{ contains(needs.prepare.outputs.version, '-') && 'beta' || 'stable' }}
+      release_run_id: ${{ github.run_id }}
+    secrets:
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    permissions:
+      contents: read
+      actions: read
+