[jmgilman]

Summary

Second cleanup PR (follows #14). The publish path keeps its real gates — protected staging/production environments, registry validation, digest/attestation verification, remote byte verification, no-op replay, and clean-install smoke tests — and sheds the ceremony:

• Rename phase5-publish.sh → publish.sh and drop its hardcoded pkgs.meigma.dev URL and _staging/ literals; the environment-scoped R2_PREFIX/PUBLIC_BASE_URL vars are now the single source of truth. Staging requires a non-empty prefix, production an empty one plus --production-root, as before.
• Delete phase5-source.sh and its moon task: it duplicated the full fetch→rebuild→install cycle the staging job repeats minutes later, and its inline assertions hardcoded exactly 5 assets / 4 packages / the amd64+arm64 shape — the same hardcoding class that recently blocked a release.
• Drop the typed confirmation phrases (publish <project> <tag> to production, empty _staging only). The phrase was duplicated in four places and only ever confirmed values the operator had already typed. Manual production publishes still require explicitly checking apply_production (default false) and a successful staging run first; trusted dispatch is unchanged (always staging → production).
• Drop the wired-in empty_staging recovery input: apply-sync already converges from any bad or empty staging state (deletions last, verification before completion), so recovery is just another staging publish.
• Delete validate_publish_event.py + test: extra dispatch-payload fields are inert, and validate-request already validates project/tag against the registry.
• Move spikes/phase0/Dockerfile.tools → docker/tools.Dockerfile (it was load-bearing despite living in a "disposable" spike), drop its shellcheck install and fixture-builder script, and delete spikes/ entirely.
• Validation job shrinks to validate-request only; workflow renamed Publish; manual project/tag inputs no longer default to a specific release.
• README/docs updated to describe the current shape.

Consumer dispatch contract (publish-package with {project, tag}) is unchanged.

Testing

• actionlint + shellcheck pass on the new workflow and scripts; go build/go test and docs:build pass locally.
• Post-merge: staging-only manual dispatch (apply_staging=true, apply_production=false) of incus-gh-runner v1.1.0 from main to prove the reworked path end to end before it's needed for a real release.

🤖 Generated with Claude Code