feat(release): publish package binaries through Cloudflare

Move files deployments to Wrangler, make CLI and desktop own their publishing destinations, add direct-download update metadata and desktop feeds, and refresh installation docs.

.github/workflows/deploy-files.yml

@@ -13,7 +13,6 @@ concurrency:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   deploy:
@@ -28,12 +27,8 @@ jobs:
         working-directory: services/files
         run: bun typecheck
 
-      - name: Authenticate with Pulumi Cloud
-        uses: pulumi/auth-actions@141415910c3beb54e03b48e9057c204c97b956f2 # v2.1.0
-        with:
-          organization: anomalyco
-          requested-token-type: urn:pulumi:token-type:access_token:organization
-
       - name: Deploy
         working-directory: services/files
-        run: bun run deploy --stack anomalyco/files/${{ github.ref_name == 'v2' && 'production' || 'dev' }} --yes --non-interactive
+        run: bun run deploy --env ${{ github.ref_name == 'v2' && 'production' || 'dev' }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.github/workflows/publish.yml

@@ -670,19 +670,6 @@ jobs:
           git config --global user.name "opencode"
           ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts || true
 
-      - name: Upload desktop release assets
-        if: needs.version.outputs.release
-        env:
-          GH_TOKEN: ${{ steps.committer.outputs.token }}
-        run: |
-          shopt -s nullglob
-          files=(/tmp/desktop/*.{exe,blockmap,dmg,zip,AppImage,deb,rpm} /tmp/desktop/*.app.tar.gz)
-          if (( ${#files[@]} == 0 )); then
-            echo "No desktop release assets found"
-            exit 1
-          fi
-          gh release upload "v${{ needs.version.outputs.version }}" "${files[@]}" --clobber --repo "${{ needs.version.outputs.repo }}"
-
       - run: ./script/publish.ts
         env:
           OPENCODE_VERSION: ${{ needs.version.outputs.version }}
@@ -694,3 +681,6 @@ jobs:
           LATEST_YML_DIR: /tmp/latest-yml
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          OPENCODE_DESKTOP_DIST: /tmp/desktop
+          CLOUDFLARE_ACCOUNT_ID: 15d29c8639fd3733b1b5486a2acfd968
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}