fix: target repository for release uploads

[chasechou007]

Summary

• pass --repo "$GITHUB_REPOSITORY" to the release-only gh release upload command
• preserve the no-checkout, least-privilege publish job
• add a workflow contract assertion so repository context cannot regress

Incident

The alpha.8 release run 30878144138 built and smoked all four native targets and verified the complete checksum matrix, but the final upload job failed because its no-checkout workspace had no .git directory for gh repository discovery.

Validation

• node --test tests/standalone-workflow.test.mjs
• npm test (178/178)
• git diff --check

Domain Grounding Used

• Grounding Request: not_required
• Accepted IDs: none
• Candidate boundaries: none

[chasechou007]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 5b9ce9b334

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".