…19825)

- Fix single-quote bug in `git ls-remote` tag check — variable was never
expanded, check always passed silently
- Fix `In-case-of-failure` rollback condition — was logically inverted
(fired when build failed, not when it succeeded); rewritten with
multi-line OR logic

- Add early check at start of `build-release`: fail immediately if a
GitHub Release for the version already exists (operator error)
- Add artifact verification step before upload in `build-release`
(checks all 3 platform tars exist and are non-empty)
- Add artifact verification step in `publish-release` after downloads
(checks all 5 files: 3 tars + 2 debs)
- Increase artifact `retention-days` from 3 → 7 (tests can run up to
46h; 3 days was too close)
- `gh release create` is now non-fatal: on failure prints a
`::warning::` annotation and copy-pasteable manual instructions so the
operator can publish without re-running the full pipeline
- Replace `github.token` with a GitHub App token (`RELEASE_BOT_APP_ID` /
`RELEASE_BOT_APP_KEY`) in `publish-release` — freshly minted per job, no
expiration issues after long test runs; releases are attributed to the
release bot
- Remove unused artifact downloads from `publish-docker-image` (tar
files were downloaded but never used — skopeo copies from registry
directly)
- `skopeo delete` failure now emits a `::warning::` instead of silently
succeeding via `&& echo`

`reusable-release-build-debian-pkg.yml`)
- Inline the reusable workflow — it was only ever called from here; one
file is clearer
- Delete `reusable-release-build-debian-pkg.yml`
- Remove unnecessary `apt-get upgrade` (was upgrading all runner
packages)
- Merge duplicate amd64/arm64 build steps into a single loop
- Add `Depends: libc6` to control file (CGO binary requires glibc)
- Fix `postinst` to use `#!/bin/sh` (Debian policy) with proper argument
handling
- Improve `postinst` message text: clearer, correct grammar, no stray
punctuation
- Document x86-64-v2 CPU requirement in the amd64 package description
- Add debian package verification step (`dpkg-deb --info`) before upload
- Remove unused `.deb.checksum` artifact uploads (4 → 2 uploads)
- Fix `retention-days` 5 → 7 for .deb artifacts

Generated with Claude.

(cherry picked from commit a87e627)

…build (#19853)

## Summary

Cherry-pick of #19825 and #19847 to `release/3.4`.

- Improve release workflow robustness (early release existence check,
artifact verification, non-fatal skopeo delete, GitHub App token for
publish step)
- Inline debian package build (removing separate reusable workflow file)
- Fix debian control file heredoc inside for loop
- Update docker actions to v4.0.0 (Node.js 24)
- Pin `actions/create-github-app-token` to v2.2.1 SHA (Node.js 24)