fix(release): repair pishoo v0.6.0 publish metadata

[eareimu]

Summary

• make pishoo S3/R2 publish commands safe in tag publish mode by using a non-empty command array
• declare Apache-2.0 license metadata for Cargo, RPM, Homebrew, and Debian package surfaces
• add tests guarding the release workflow publish command shape and package license metadata

Verification

• cargo +nightly fmt -- --check
• git diff --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets --all-features

Release follow-up

After this PR merges, move v0.6.0 to the merged commit and track only the tag-triggered pishoo DEB/RPM/Homebrew publish jobs.