ci: compose signed source releases from RC tags

[tisonkun]

Summary

Pushing an RC tag such as v0.7.3-rc.1 builds its source archive, generates a SHA-512 checksum, signs it with the ASF project key, and uploads the three release files through apache/tooling-actions/upload-to-atr.

Pull requests changing release-compose.yml or .asf.yaml run packaging checks against the PR checkout and skip signing and uploading.

Design Notes

• Follow the existing vX.Y.Z-rc.N tag convention. Read the release version from the tag, require it to match asyncband/Cargo.toml, and verify the checked-out tag commit belongs to main, as the existing crate release workflow does.
• Build on Ubuntu 24.04 with git archive | gzip -n -9, fixed archive permissions, and no gzip filename or timestamp. Archive the tag's exact commit and record the tag, commit, and checksum in the workflow summary.
• Separate build, sign, and upload jobs, passing artifacts by their exact IDs. Only upstream RC tag pushes can sign; only upload has OIDC permission. Signing uses a temporary keyring and verifies the expected fingerprint.
• Upload .tar.gz, .tar.gz.asc, and .tar.gz.sha512 under ATR version X.Y.Z; each upload creates a new revision. Record that revision alongside the RC tag before voting. Retry failed upload jobs with the existing signed artifact after inspecting ATR's state.
• .asf.yaml registers the repository and compose workflow path for tag-triggered uploads. Voting, final publication, and the existing crates.io workflow are unchanged.

For the Trusted Publishing signing-key application, submit this pipeline for ASF Security's reproducibility confirmation and request a key with a UID such as Asyncband Automated Release Signing <private@asyncband.apache.org>. Configure:

• Secret GPG_SECRET_KEY: ASCII-armored private key provisioned by ASF Infrastructure.
• Variable SOURCE_SIGNING_FINGERPRINT: full uppercase primary-key fingerprint.
• Optional secret GPG_PASSPHRASE: passphrase if the supplied key is protected.

Publish the public key through the existing project KEYS management and confirm ATR imports it and applies the compose policy.

Validation: executed the packaging script against the existing annotated v0.7.2-rc.1 tag in a disposable Linux environment and verified its archived source, version, and checksum. PR packaging, invalid RC tags, manifest mismatch, checkout/tag mismatch, and unmerged candidate rejection pass. Temporary-key signing, detached verification, and keyring cleanup pass. actionlint, cargo x lint, and git diff --check pass. Actual ATR upload awaits the project signing key and live trust configuration.

Related to #303.