Bound release network operations and recover Sentry finalization

[baron]

Summary

• bound Sentry release API connect and total request times
• reconcile ambiguous transport and HTTP 5xx outcomes through authoritative GET observation before retrying or failing closed
• add resumable Sentry finalization recovery
• bound SwiftFormat and promotion downloads with true aggregate remaining-budget deadlines
• isolate failed-attempt curl stdout so successful --write-out results cannot be corrupted
• preserve current-main shared release_sentry_symbols authority and Tip-Sentry lifecycle

This current-main replacement supersedes #573, which became merge-conflicted after the Tip-Sentry changes landed. #573 is intentionally left untouched for audit until a maintainer chooses to close it.

Review

• implemented and integrated in the dedicated PR6 worktree
• original plan and implementation were both reviewed by Fable
• after the current-main conflict integration, Fable was consulted again on the final stable commit
• final exact-Fable verdict: no must-fix issues remain
• an independent fallback review found three load-bearing retry/deadline issues; all were fixed and re-reviewed before the final Fable pass

Validation

• python3 -m unittest Scripts.test_release_tooling: 87 tests, all passed (final Fable review run)
• focused Sentry mutation, deadline-budget, promotion write-out, and formatter fixtures passed
• bash -n on all changed shell scripts passed
• Python compile checks passed
• mandatory commit and push preflights passed, including guardrails and outgoing-range secret scan
• git diff --check: clean
• exact outgoing range: three commits, four files

Validation boundary

This is a source/tooling-only change; live/debug app validation is intentionally deferred. Exact-head hosted merge-ref CI is required before merge.

[baron]

Current-main refresh on exact head 1ef1197e8bf9556c7021be6a84057e912920f950: the bounded release-network/finalization work still merges cleanly in a local synthetic integration, but GitHub's hosted merge/check evidence is stale. Please refresh exact-current-main CI and obtain a non-author exact-head approval before merge. As the author, I cannot self-approve.

[morluto]

Audit disposition — merge candidate after exact-head CI (2026-08-14)

The shared remaining-budget deadlines, bounded connect/request attempts, isolation of failed curl output, and reconciliation of ambiguous Sentry mutations through authoritative observation form a coherent release-safety design. The resumable finalization path is preferable to blind mutation retry.

Please rerun the shell/HTTP failure matrix and hosted merge-ref checks on the final head. I did not find a code-level blocker in the reviewed release-tooling change.

[morluto]

Deep-review assessment — 2026-08-14

Disposition: merge candidate after exact-head hosted checks. The aggregate remaining-budget deadlines, bounded connection/request timeouts, isolated curl output, and authoritative GET reconciliation after ambiguous mutation outcomes form a coherent release-network contract. The retry logic fails closed rather than blindly repeating a possibly committed Sentry mutation.

I did not find a must-fix in the reviewed design. Please require current merge-ref CI and the focused transport/5xx/deadline tests on the final head. After merge, close #573 as superseded so there is one release-finalization authority.