fix(ci): manual Fury uploads with per-file error handling

GoReleaser's built-in fury publisher gives opaque 400 errors with no
per-file diagnostics. Replace with manual curl uploads that show the
exact HTTP response for each package, and handle 409 (already exists)
gracefully.

Also passes release_tag to verify-installers so it uses the correct
version string instead of the branch name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2xburnt

.github/workflows/publish-release.yaml

@@ -125,24 +125,7 @@ jobs:
       - name: Install syft
         uses: anchore/sbom-action/download-syft@v0
 
-      - name: Purge existing Fury packages (idempotent re-runs)
-        env:
-          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
-          RELEASE_TAG: ${{ needs.resolve-tag.outputs.tag }}
-        run: |
-          VERSION="${RELEASE_TAG#v}"
-          ACCOUNT="burnt"
-          for fmt in deb rpm apk; do
-            echo "Deleting xiond ${VERSION} (${fmt}) from Fury if it exists..."
-            curl -sf -X DELETE \
-              -H "Authorization: Bearer ${FURY_TOKEN}" \
-              "https://push.fury.io/api/v1/repos/${ACCOUNT}/packages/${fmt}/xiond/versions/${VERSION}" \
-              && echo "  ✅ Deleted ${fmt}" \
-              || echo "  ⏭️  Not found or already removed (${fmt})"
-          done
-
-      - name: Run GoReleaser (Fury only)
-        continue-on-error: true
+      - name: Run GoReleaser (packages + homebrew)
         uses: goreleaser/goreleaser-action@v6
         env:
           FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
@@ -162,6 +145,34 @@ jobs:
           version: "~> v2"
           args: release --config .goreleaser/release.yaml --skip=announce,validate
 
+      - name: Upload packages to Gemfury
+        env:
+          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
+        run: |
+          FAILED=0
+          for pkg in release/*.deb release/*.rpm release/*.apk; do
+            [ -f "$pkg" ] || continue
+            BASENAME=$(basename "$pkg")
+            echo "Uploading ${BASENAME}..."
+            RESPONSE=$(curl -sS -w "\n%{http_code}" \
+              -F "package=@${pkg}" \
+              "https://${FURY_TOKEN}@push.fury.io/burnt/")
+            HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+            BODY=$(echo "$RESPONSE" | sed '$d')
+            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+              echo "  ✅ ${BASENAME} (HTTP ${HTTP_CODE})"
+            elif [ "$HTTP_CODE" = "409" ]; then
+              echo "  ⏭️  ${BASENAME} already exists (HTTP 409)"
+            else
+              echo "  ❌ ${BASENAME} FAILED (HTTP ${HTTP_CODE})"
+              echo "  Response: ${BODY}"
+              FAILED=1
+            fi
+          done
+          if [ "$FAILED" = "1" ]; then
+            exit 1
+          fi
+
   verify-installers:
     name: Verify Package Installers
     needs: [publish-fury, resolve-tag]

.goreleaser/release.yaml

@@ -81,10 +81,10 @@ checksum:
 #     cmd: gpg2
 #     #- args: ["-u", "<key id, fingerprint, email, ...>", "--output", "${signature}", "--detach-sign", "${artifact}"]
 
-# Docs: https://goreleaser.com/customization/fury/
-gemfury:
-  - account: burnt
-    disable: "{{ .IsSnapshot }}"
+# Fury uploads handled by workflow step for better error handling
+# furies:
+#   - account: burnt
+#     disable: "{{ .IsSnapshot }}"
 
 # Docs: https://goreleaser.com/customization/homebrew/
 homebrew_casks: