fix(tcloud-release): retain inspected release tarball

[drewstone]

Summary

• Retain the inspected release tarball as a 90-day Actions artifact before consumer and registry steps.
• Pin actions/upload-artifact to the verified v7.0.1 commit.

Context

The exact 0.6.0 tag at c6e4c17bdeeeef9de6f3b32ad1040646f1c4b84a passed release validation, build, package tests, packed-artifact inspection, and fresh-consumer bundling in run 36370799261. The final npm PUT returned E404, and that run retained no downloadable artifact. The logged tarball SHA1 was 3c981edab3681645e41481578726b889cf5eda48.

Merged PR #61 already removes the rejected NPM_TOKEN and uses the existing OIDC publisher path. This change keeps package source, version, and release tag unchanged while preserving the exact tarball if registry authorization fails again.

Verification

• actionlint .github/workflows/release.yml
• git diff --check

No local build or tests were run. The exact-source Actions build and consumer checks are recorded above.

[tangletools]

✅ Auto-approved PR — d94f0036

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-28T03:01:39Z}