Serve installer binaries from Cloudflare R2

[Teakowa]

Goal

Use Cloudflare R2 as Wright's default binary distribution endpoint for install.sh, while keeping GitHub Releases as the canonical release record and artifact provenance source.

The default install path should not depend on the GitHub Releases API to resolve or download the latest Wright binaries.

Context

Wright already has one authoritative release build pipeline and a thin installer that consumes its packaged archives and SHA-256 checksums. The distribution layer can remain equally thin: publish the exact release artifacts to R2 after a GitHub Release succeeds, then expose stable versioned and latest routes for installation.

This should improve distribution independence and avoid making routine installs depend on GitHub API availability or rate limits without introducing a second release/build system.

Scope

R2 distribution contract

Publish the same native archives and checksum files produced by the Wright release workflow to a WrightKit-controlled R2 bucket behind a production custom domain, expected to use a route such as:

https://releases.wrightkit.dev/releases/<version>/wright-<version>-<target>.<ext>
https://releases.wrightkit.dev/releases/<version>/wright-<version>-<target>.<ext>.sha256
https://releases.wrightkit.dev/latest/wright-<version>-<target>.<ext>
https://releases.wrightkit.dev/latest/wright-<version>-<target>.<ext>.sha256

The exact object naming may be simplified during implementation, but the public contract must support both:

• an immutable version-pinned route for CI/reproducible installs;
• a stable latest route for normal end-user installation without a separate GitHub API lookup.

Versioned objects must not be overwritten after publication.

Release integration

Extend the existing Wright release workflow so R2 publication consumes the already-built and verified release artifacts rather than rebuilding binaries.

Publication ordering must ensure latest is only updated after:

1. the GitHub Release has been successfully published;
2. the complete versioned artifact/checksum set has been uploaded to R2;
3. the uploaded R2 artifacts have been verified as retrievable and checksum-consistent.

A failed or partial release must not advance latest.

Installer

Update the canonical install.sh so:

• the default latest install downloads through the R2 latest route and does not call the GitHub Releases API;
• --version <version> uses the immutable R2 versioned route;
• SHA-256 verification remains mandatory;
• existing platform detection, archive-layout validation, installation behavior, and post-install smoke checks remain intact;
• distribution URLs remain overridable for tests/advanced use where useful.

GitHub Release downloads may remain available as a documented/manual fallback, but the default installer path should not require them.

Cache behavior

Use cache semantics appropriate to the route contract:

• versioned artifacts may be cached long-term as immutable content;
• latest must be refreshed or purged as part of successful publication so a completed release becomes observable without serving stale binaries indefinitely.

Non-goals

• introducing a second binary build pipeline;
• replacing GitHub Releases as Wright's canonical release record;
• building a package registry or dependency manager;
• adding a Worker/API service when static R2 routes are sufficient;
• implementing Wright self-update behavior;
• changing Homebrew, WinGet, or other package-manager ownership unless required by this distribution contract.

Acceptance criteria

• The Wright release workflow publishes each supported native archive and checksum to an immutable versioned R2 route after the GitHub Release succeeds.
• R2 publication reuses the verified release artifacts and does not rebuild Wright.
• The workflow verifies the R2 copy before advancing latest.
• latest is updated atomically enough that installers cannot observe a partial new release artifact set.
• Default install.sh latest installation no longer calls the GitHub Releases API.
• install.sh --version <version> installs from the immutable versioned R2 route.
• Installer checksum verification remains mandatory for both latest and pinned installs.
• Versioned R2 artifacts are immutable after publication.
• Cache behavior for versioned and latest routes is defined and validated.
• GitHub Releases remain the canonical release/provenance record and retain the corresponding release artifacts.

Dependencies / ownership

• wright owns the installer and release workflow changes.
• Cloudflare R2 bucket/custom-domain configuration is infrastructure required by the distribution contract.
• Builds on the release and installation contracts established by Establish automated binary releases and the Wright v0.1 distribution contract #101 and Add first-class installation and package-manager distribution #108; this issue changes the default distribution endpoint, not the authoritative build provenance.