test(canary): run the live zed GitHub and Cloudflare round trip - #1

Summary

Turn the public canary into the write-owning E2E fixture for Zed's production fallback chain.

Workflow contract

• pin exact zed-cli and E2E harness commits
• keep the canary package checkout isolated from product/harness source trees
• run real zed publish with the configured registry unavailable
• write the GitHub Release artifact and sidecar with this repository's scoped token
• verify direct GitHub SHA-256 and size
• verify Cloudflare CDN byte parity, provenance headers, and immutable caching
• force normal and frozen installs to use direct GitHub by disabling both registry and R2
• probe Cloudflare registry metadata reconstruction last, as an independent production edge gate

Exact run evidence

Run https://github.com/zed-pkg-test/github-api-fallback-canary/actions/runs/33561248797 used:

• canary head b3081e2f3b444fc8bad07b4efb65f2c20ad79a7b
• zed-cli head 71a8b4c45e1f8e938b33ef19cd1468b2741e58f9
• E2E harness head 867948ff6221b9263d0e9852f17789940ab6722e
• package zed-pkg-test/github-api-fallback-canary@0.0.3

Passed phases:

• exact input SHAs and isolated package root
• exact zed release build
• real GitHub Release publish while registry write was unreachable
• public Release archive and metadata-sidecar reads
• 347-byte archive with SHA-256 400dd982923d917edbc766c8e63b2e3abbab69b95eea49d100701570baed3f56
• byte-identical cdn.zpkg.net/github/... response with expected Zed CDN/source headers
• direct-GitHub normal install with registry and R2 unavailable
• clean-store frozen reinstall with the same digest and no lockfile drift

Failed independent phase:

• registry.zpkg.net/v1/packages/.../versions/0.0.3 returned Cloudflare's generic HTTP 502 with retry-after: 60 and no x-zed-edge / x-zed-source; the checked-in registry Worker is not yet deployed on the live route

The optional GHCR mirror also returned 401 in this run, while the required GitHub Release mirror succeeded. GHCR authorization can be investigated separately without invalidating the proven Release/direct-GitHub/CDN path.

Safety

The payload is deterministic and public. No chat-provided credential is committed or logged. The workflow uses only GitHub's repository-scoped Actions token and never assumes sibling-repository write authority.

Depends on zed-pkg/zed-cli#305, zed-pkg-test/zed-pkg-e2e#176, and the registry Worker deployment in zed-pkg/zed-infra#25. This PR remains draft until the public registry edge gate passes.