ci: chain publish + artifact registration into the release run

.github/workflows/release.yml

@@ -1,15 +1,43 @@
 name: release
 
+# Full release pipeline in ONE chained run: release-please -> docker build+push
+# to ECR Public -> np artifact registration -> release finalized with the
+# artifact metadata (image, digest, pinned reference, artifact id) and
+# force-published.
+#
+# Chained on purpose: release-please creates tags with GITHUB_TOKEN, and
+# GitHub never triggers workflows from bot-token events — a separate
+# `on: push: tags` publish workflow does not fire (and the delete/re-push
+# workaround flips the release to Draft).
+#
+# Recovery / backfill: run this workflow manually with existing_tag to
+# publish + finalize a tag that already exists (a release whose publish
+# failed, or a pre-pipeline tag with no artifact metadata).
 on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      existing_tag:
+        description: 'Publish + finalize an existing tag (recovery/backfill)'
+        required: true
+        type: string
 
 permissions:
   contents: write
   pull-requests: write
+  id-token: write   # OIDC auth against AWS for the ECR push
 
 jobs:
   release:
-    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
-    secrets: inherit
+    uses: nullplatform/actions-nullplatform/.github/workflows/release-publish-oci.yml@main
+    with:
+      image_name: scopes/lambda
+      # Same behavior as the previous release.yml caller (shared defaults).
+      release-type: terraform-module
+      update_readme_versions: true
+      existing_tag: ${{ inputs.existing_tag || '' }}
+    secrets:
+      aws_role_arn: ${{ secrets.AWS_ROLE_ARN_ECR_PUSH }}
+      artifact_np_api_key: ${{ secrets.ARTIFACT_NP_API_KEY }}