docs(tui): require manual R2 artifact dispatch

[lawrencecchen]

Summary\n\nCorrect the R2 artifact release guide to match cmux-tui-artifacts.yml. The workflow is workflow_dispatch-only, so a tag push does not start it. The guide now gives the explicit gh workflow run command for an intentional raw-artifact publish and keeps npm/PyPI publishing separate.\n\n## Red/green history\n\n- 7932fe6 adds the failing manual-dispatch documentation contract.\n- 1fbbf22 documents the required manual dispatch and removes the stale tag-push claim.\n\n## Dependency\n\nThis PR is based on the current P2/postpublish head 31896f1 from PR 10268.\n\n## Verification\n\n- 71 TUI publish workflow security tests\n- 8 published-manifest tests\n- 9 TUI package contract tests\n- actionlint for cmux-tui-artifacts.yml\n- Python compile and git diff checks\n\nNo R2 workflow dispatch, tag, package publish, merge, or settings change was performed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Updates the TUI release docs to require manual dispatch for R2 artifact publishing and adds tests that enforce this. Previously we claimed a tag push ran the artifact workflow; now only workflow_dispatch triggers it, and the docs show the gh workflow run command.

• Verify cmux-tui-artifacts.yml uses only workflow_dispatch and not push.
• Confirm cmux-tui/dist/RELEASING-TUI.md removes the tag-push claim and documents gh workflow run cmux-tui-artifacts.yml --ref <ref>.
• Review the new security test that checks triggers and documentation for the artifact workflow.
• No change to npm/PyPI publishing; use the release-cut workflow for coordinated stable releases.
• Migration: when publishing raw R2 artifacts, run gh workflow run cmux-tui-artifacts.yml --ref <ref>; a tag push will not start the workflow.

^{Written for commit 1fbbf22. Summary will update on new commits.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 369580a2-a492-4c58-a15c-a65c944e5ba3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}