fix(release): repair product download metadata

[eareimu]

Summary

• switch Homebrew and Scoop public package URLs from download.genmeta.net to the live R2 public domain download.dhttp.net
• publish gmutils DEB metadata into the unified genmeta APT repository used by users
• generate complete genmeta APT Release metadata with main, contrib, and non-free components
• guard mutable APT metadata uploads with remote ETag/missing preconditions to avoid cross-publisher races with pishoo
• make versioned Homebrew/Scoop immutable archive keys reusable as the metadata source of truth when the remote object already exists
• add regression coverage for release workflow destinations, APT metadata generation, conditional metadata uploads, and same-version immutable payload metadata planning

Release recovery context

The first v0.6.0 product tag run uploaded objects successfully, but the generated Homebrew/Scoop metadata embedded download.genmeta.net URLs. Those URLs currently return 404, while the uploaded objects are live under download.dhttp.net.

The DEB release job also targeted the split apt/gmutils repository. Users consume the existing unified repo at https://download.dhttp.net/ppa/genmeta, so the release workflow must write ppa/genmeta with suite/codename genmeta and preserve the archive metadata shape expected by that source.

Because the v0.6.0 archive objects already exist, a retag/rerun must refresh mutable formula/json/APT metadata without trying to overwrite same-version immutable archives. The versioned payload planner skips existing remote archive keys and renders metadata with the remote sha256 when a local rebuild differs. APT mutable metadata uploads are now conditional on the remote baseline so concurrent gmutils/pishoo publishing fails safely and can be rerun instead of silently overwriting the other index update.

Verification

• cargo +nightly fmt
• cargo +nightly fmt -- --check
• git diff --check
• cargo test -p xtask publish::s3::deb::tests
• cargo test -p xtask
• DHTTP_ROOT_CA=/home/yiyue/code/reimu/keychain/root.crt DHTTP_STUN_SERVER=nat.genmeta.net:20004 DHTTP_H3_DNS_SERVER=https://dns.genmeta.net:4433 DHTTP_HTTP_DNS_SERVER=https://dns.genmeta.net DHTTP_MDNS_SERVICE=_genmeta.local DHTTP_CERT_SERVER_URL=https://license.genmeta.net cargo clippy --all-targets --all-features -- -D warnings
• DHTTP_ROOT_CA=/home/yiyue/code/reimu/keychain/root.crt DHTTP_STUN_SERVER=nat.genmeta.net:20004 DHTTP_H3_DNS_SERVER=https://dns.genmeta.net:4433 DHTTP_HTTP_DNS_SERVER=https://dns.genmeta.net DHTTP_MDNS_SERVICE=_genmeta.local DHTTP_CERT_SERVER_URL=https://license.genmeta.net cargo test --all-targets --all-features

Note: clippy/test still emit the pre-existing future-incompatibility warning for proc-macro-error2 v2.0.1, but both commands exit successfully.