feat: publish alpha and beta channels

[haasonsaas]

Summary

• publish alpha daily at 05:00 UTC from current main
• publish beta 30 minutes later from main^, keeping it one source commit behind alpha
• publish immutable prerelease tags and npm alpha / beta dist-tags; stable continues to use latest
• let installers and the native updater opt into stable, alpha, or beta, with stable remaining the default
• generate runtime passports plus release metadata, sign the complete channel manifest with the stable or preview Ed25519 key, and publish channels/<channel>/{version.json,manifest.json} to GCS
• keep the stable legacy maestro/version.json pointer and remove mutable GitHub channel-alias releases

CI migration

Legacy GitHub validation workflows are absent and guarded by the Buildkite pipeline contract. GitHub Actions remains only for release and repository-governance automation.

Security

Channel manifests bind the release SHA, metadata digest, immutable release URL, channel, and key ID. Stable and preview private keys are repository secrets in both source repositories; no key material is committed. Native artifacts and runtime passports remain covered by Cosign signatures.

Verification

• 62 focused release, channel, runtime-passport, and Buildkite contract tests
• actionlint .github/workflows/release.yml .github/workflows/channel-release.yml
• shellcheck scripts/test-install.sh scripts/run-buildkite-jetbrains.sh
• full npm run check on the delegated Linux host, including cargo check --workspace --all-targets --locked
• internal exact-head Buildkite chore: sync public mirror from internal #242 passed before protected merge of #3469
• generated public mirror Buildkite Fix release-context CI: lazy-load glob in workspace-utils #41 passed before protected merge of chore: sync public mirror from internal #1030
• no channel release was triggered

Internal sources: evalops/maestro-internal#3467, evalops/maestro-internal#3468, evalops/maestro-internal#3469

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.