publish: a re-run on an existing release does not attach the assets it is missing (spec 0004 D8)

Spec 0004 D8 says: "A re-run of the tag job must therefore treat an existing release as the starting point and attach only what is missing, rather than refusing."

What ships: on forge.ErrAlreadyExists the release path reports the release as not created and stops (pkg/publish/publish.go, the ErrAlreadyExists branch in release). It does not list the existing release's assets, and it does not attach any that are absent. So the "do not fail on a re-run" half of D8 is built and the "finish a half-finished release" half is not.

Where it bites: not on GitLab, where CreateReleaseWithAssets creates the release with every link in one request, so a release either exists complete or does not exist. It bites on GitHub and Gitea, where assets are uploaded one by one after the release is created: a job that dies mid-upload leaves a release with some assets, and every re-run leaves it that way.

Two honest resolutions, and which one is the maintainer's call:

1. Build it: on ErrAlreadyExists, fetch the release, diff its assets against the manifest, attach the difference. Needs a forge read of a release's assets by tag, which Provider.GetReleaseByTag gives.
2. Narrow D8 with a dated note to what shipped, and record that a half-attached release on GitHub or Gitea is repaired by deleting the release and re-running, since there is no DeleteRelease in the contract either.

Spec 0004 carries a dated note pointing here as of 2026-09-03.