fix(release): make S3 uploads R2-compatible

[eareimu]

Summary

• configure the xtask S3 client to calculate request checksums only when required
• avoid the AWS SDK Rust default flexible-checksum aws-chunked PutObject path that Cloudflare R2 rejects
• add a regression test for the S3 client checksum policy

Release context

The first v0.6.0 tag product publish jobs failed on real S3/R2 uploads with dispatch failure at the first PutObject on DEB/RPM/Scoop/Homebrew surfaces. PR dry-runs passed because they do not upload immutable payloads.

Cloudflare R2's S3 compatibility guidance requires disabling chunked upload behavior in other AWS SDKs. AWS SDK for Rust 1.119 defaults PutObject to flexible checksum calculation (WhenSupported), which enables aws-chunked for streaming request bodies. Setting RequestChecksumCalculation::WhenRequired keeps the existing explicit path-style R2 client while avoiding that default chunked upload path.

After this merges, the release tag must be recreated/moved to the merged commit before rerunning tag product publish, because tag workflows use the workflow/source at the tag commit.

Verification

• cargo +nightly fmt -- --check
• git diff --check
• cargo test -p xtask s3_client_calculates_request_checksums_only_when_required -- --nocapture (failed before implementation, passed after)
• cargo test -p xtask --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features