ci: publish immutable Buzz test prereleases

[reinhold-ph]

Why

Buzz needs a permanent, low-cost way to build one exact source commit on GitHub-hosted Apple Silicon and distribute the unsigned test app through a direct GitHub prerelease download. The expensive build must never run from ordinary pushes or pull requests.

Architecture

• Adds a manual-only Build Buzz Test Release workflow selected from trusted main.
• Requires and verifies a full 40-character source SHA independently from the workflow ref.
• Rejects an existing immutable release/tag during cheap Linux preflight before allocating macOS.
• Uses one ARM64 macOS build with separately scoped pnpm, Cargo, compiler, and native mesh caches.
• Verifies the runner, Rust host, and packaged Mach-O are ARM64.
• Produces an unsigned, non-updating app ZIP, manifest, and SHA-256 checksums.
• Transfers those files internally to a least-privilege publication job.
• Creates a private draft prerelease, creates and verifies the exact Git tag, checks the complete asset/manifest/checksum boundary, then makes the prerelease visible.
• Adds a dependency-free, path-scoped contract workflow rather than modifying broad CI.

Scope

Infrastructure only:

• .github/workflows/buzz-test-release.yml
• .github/workflows/buzz-test-release-contract.yml
• scripts/test-buzz-test-release-workflow.py

No Buzz product/runtime behavior changes.

Verification

• Dependency-free workflow contract passes under python3 -S.
• Both workflows parse as YAML.
• Bash syntax passes for all 20 run blocks.
• Every action reference is pinned to an immutable commit SHA.
• Manifest fixtures accept a valid handoff and reject extra files and identity tampering.
• Existing desktop-candidate and signed-canary contracts pass.
• Independent release-integrity review: PASS.
• Base-to-head diff is exactly the three infrastructure files.
• Product changed-path filters evaluate false; no expensive product build is expected from this PR.

Repository-wide pnpm run check reaches admin-web Biome successfully but cannot complete locally because workspace node_modules/tsc are absent; no unapproved dependency installation was performed.

Explicit non-goals

This PR does not dispatch the workflow, build a candidate, create a release, sign/notarize an app, or publish a stable production release.