ci: atomic release publish hard-gated on OpenUPM signing

[IvanMurzak]

Summary

Restructures release.yml so the GitHub Release is created as a single atomic publish gated on every prerequisite. Mirrors the parent Unity-MCP repo changes (#776 + #777 combined).

• prepare-release-notes (new): generates release.md (preserving the # Package $version header) in parallel with tests/builds and uploads it as the release-notes artifact.
• build-signed-upm-package (new): signs com.ivanmurzak.unity.mcp.particlesystem (Unity-Package/Assets/root) with Unity's UPM CLI, verifies attestation + the com.ivanmurzak.unity.mcp.particlesystem- basename prefix, and uploads the signed .tgz. HARD GATE — not continue-on-error; missing signing secrets ::error:: + exit 1.
• release-unity-plugin (rewritten): downloads the release-notes, unity-installer-package, and signed-upm-package artifacts and creates the Release + tag in a single softprops/action-gh-release@v2 call with body_path + fail_on_unmatched_files: true. Inline release-notes generation removed; unused success/release_notes outputs dropped.
• publish-unity-installer removed; cleanup-artifacts re-pointed at release-unity-plugin and now also deletes signed-upm-package and release-notes.
• All existing Unity test jobs (editmode + playmode + standalone) preserved unchanged.
• Adds docs/openupm-signing.md.

⚠️ Action required before next release

This workflow is hard-gated on signing. Three repo secrets MUST be configured on IvanMurzak/Unity-AI-ParticleSystem or the next release will hard-fail with no Release created:

gh secret set UPM_SERVICE_ACCOUNT_KEY_ID     --repo IvanMurzak/Unity-AI-ParticleSystem
gh secret set UPM_SERVICE_ACCOUNT_KEY_SECRET --repo IvanMurzak/Unity-AI-ParticleSystem
gh secret set UPM_ORG_ID                     --repo IvanMurzak/Unity-AI-ParticleSystem

See docs/openupm-signing.md for the full one-time setup (including the openupm/openupm trackingMode: githubRelease listing change).

Test plan

• python -c "import yaml; ..." structural validation passes (jobs present/absent, needs wired, no continue-on-error on the signed-package job).
• No remaining publish-unity-installer / .outputs.success / .outputs.release_notes references.
• Configure the three UPM signing secrets on this repo.
• Confirm next release attaches both the .unitypackage and com.ivanmurzak.unity.mcp.particlesystem-<version>.tgz.

Closes #15

[Copilot]

Pull request overview

This PR restructures the release workflow so the GitHub Release is published as a single atomic step that is hard-gated on all prerequisites, including building and verifying a signed OpenUPM UPM tarball.

Changes:

• Adds prepare-release-notes job to generate release.md early and publish it as a release-notes artifact.
• Adds build-signed-upm-package job to sign + verify the UPM package and upload it as a signed-upm-package artifact (hard gate).
• Rewrites release-unity-plugin to download all artifacts and create the Release + tag in one softprops/action-gh-release@v2 call; updates cleanup accordingly and adds OpenUPM signing setup docs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/release.yml	Adds parallel release-notes + signed-package jobs and switches release publication to a single atomic release step gated on all prerequisites.
docs/openupm-signing.md	Documents the one-time OpenUPM/Unity org setup and explains the hard-gated signing/release flow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.