Add workflow propagating release bundles to legacy channels

[jsokol]

Description

On repository_dispatch (event publish-bundle, sent by code-development's sync workflow after each release publish here), downloads the release asset and propagates those exact bytes to the legacy distribution channels:

• simplerisk/bundles (master) — via the Git Data API, never a clone (the repo is 3.4 GB; even depth-1 fetches every tarball); idempotent identical-skip, replace on re-release
• s3://simplerisk-downloads/public/bundles/ — unconditional overwrite via OIDC; a re-release means the old object is stale by definition
• releases.xml (prod branch of updates.simplerisk.com) — bundle_md5 rewritten and bundle_sha256 added for the version's entry, so the www download page's displayed checksums always match the file its link serves; warn-don't-fail when the entry doesn't exist yet

All steps converge on re-dispatch. workflow_dispatch with a version input for manual heals.

Design spec: code-development docs/superpowers/specs/2026-06-06-release-bundle-propagation-design.md. Companion code-development changes (dispatch call + testing-channel checksums): simplerisk/code-development#1764.

Requires before first dispatch: CORE_SYNC_APP_ID/CORE_SYNC_APP_PRIVATE_KEY secrets (set), Core Sync App installed on bundles + updates.simplerisk.com (done), and AWS_REGION / DOWNLOADS_BUCKET / DOWNLOADS_PUBLISHER_ROLE_ARN variables + OIDC role trusting this repo's master with PutObject on public/bundles/* (pending).

🤖 Generated with Claude Code