Add M1 release packaging workflow

[anandh8x]

Summary

• Add release artifact naming helpers for platform/architecture-specific packages
• Add bun run package:release to build, smoke-check, package, and checksum release artifacts
• Add manual/tag-triggered Release Artifacts workflow for Linux/macOS/Windows uploads

Artifact behavior

• Linux/macOS produce zero-v<version>-<platform>-<arch>.tar.gz
• Windows produces zero-v<version>-windows-<arch>.zip
• Each package also emits a matching .sha256 file

Verification

• bun install --frozen-lockfile
• bun test
• bun run typecheck
• bun run build
• bun run smoke:build
• bun run package:release
• git diff --check

[gnanam1990]

Code Review Summary

Verdict: Approved

The release packaging slice looks good overall:

• Adds a clear package:release script that builds, smoke-checks, stages, archives, and writes a matching .sha256 checksum.
• Artifact naming helpers correctly normalize darwin -> macos, win32 -> windows, and select .zip for Windows vs .tar.gz elsewhere.
• The workflow supports both manual dispatch and v* tag pushes across Linux, macOS, and Windows.
• Naming behavior is covered by tests, and CI is green on all three OSes.

Non-blocking note

• scripts/package-release.ts — Linux/macOS archives are created with tar -C ${stagingDir} -czf ${archivePath} ., so extracting the tarball places files directly into the current directory instead of under a top-level zero-v<version>-<platform>-<arch>/ folder. That is fine if intentional, but top-level folders are usually cleaner for release archives.

[Vasanthdev2004]

Blockers

None found.

Non-Blocking

• The Windows .zip and Linux/macOS .tar.gz package contents extract directly into the current directory instead of a top-level zero-v<version>-<platform>-<arch>/ folder. That is acceptable for this slice, but a top-level folder would be cleaner for manual extraction.
• PR Add M1 release packaging workflow #14 was authored before [codex] p0 foundation tools #11/feat: add Zero provider runtime resolver #12 landed on main, so I also tested a merge into current origin/main; it merged cleanly and passed validation.

Looks Good

• package:release builds, smoke-checks, stages README/package/VERSION plus the binary, creates the right Windows archive name, and writes a matching .sha256 file.
• Release naming helpers correctly normalize darwin -> macos, win32 -> windows, and choose .zip only for Windows.
• Manual/tag-triggered workflow is straightforward and uploads all dist/release/* outputs across ubuntu, macOS, and Windows.
• Local PR-branch validation: typecheck passed, build/smoke/package passed, and 69/69 tests passed.
• Test-merge into current origin/main: typecheck passed, build/smoke/package passed, checksum verified, and 97/97 tests passed.

Verdict: Approve — clean release packaging foundation with working artifact generation and checksum output.

[Vasanthdev2004]

Approved — release packaging, workflow wiring, archive naming, smoke packaging, and checksum verification all checked out locally and on a test-merge into current main.