feat: publish verified public Tabex binaries

[anandpant]

Summary

• add a trusted stable-only publisher that mirrors only the Darwin arm64 and Linux amd64 Tabex native-host archives
• verify private GitHub digests, exact archive layout, regular executable entries, and the resulting public release before continuing
• switch future tabex-bin metadata to anonymous public release URLs and serialize the shared bump branch

Verification

• bash -n scripts/*.sh
• ./scripts/publish-tabex-release.test.sh
• ./scripts/update-tabex-bin.test.sh
• actionlint .github/workflows/*.yml
• git diff --check
• Codex review rechecked archive type and concurrency findings

Full validate-packages.sh is not run locally because makepkg is absent; the PR validation workflow runs it in archlinux:base-devel.

Coordination

Ready for review, but do not merge or dispatch before the Native Messaging implementation is merged and its stable release is authorized. The concurrent Tabex implementation PR must replace its direct package-bump fanout with publish-tabex-release.yml dispatch, then wait for the exact verified public mirror before dispatching the Homebrew bump. No release was published by this PR.

[anandpant]

• feat: publish verified public Tabex binaries #28 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.