ci(rp-4): publish-cli-release-assets fires when 3 of 4 CLI builds succeed

Windows build-cli-windows has been the persistent failure across v0.1.6/
v0.1.7/v0.1.8 (3 attempts) — keeps failing at 'Package zip' even with
choco install zip + as_posix() on ORT_CAPI + the script's bsdtar
fallback. Without reproducible local Windows env to debug, this is
becoming the blocker for the brew tap shipping at all.

Resolution: loosen publish-cli-release-assets dependency on Windows
specifically, while keeping it in 'needs' so we can pick up the
.zip automatically when Windows starts succeeding later.

  - if: condition now checks each needed job's .result individually
    (Linux CPU + Linux GPU + macOS arm64 must succeed)
  - fail_on_unmatched_files: false on the action-gh-release step
    so a missing .zip glob doesn't fail the attach step
  - build-cli-windows still runs every release; its artifact (when
    successful) is picked up automatically by the cli-* glob

Trade-off: GH Release ships 6 of 8 assets until Windows is fixed.
Operators on Windows fall back to the Python wheel or Docker until
the .ps1 installer has a tarball to install.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: zhmiao

.github/workflows/release.yml

@@ -788,7 +788,19 @@ jobs:
 
   publish-cli-release-assets:
     name: Attach CLI tarballs to GitHub Release
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
+    # Tag-push only; skips on hyphenated tags (RC / pre-release).
+    # Fires when the 3 reliable CLI builds succeed; build-cli-windows is
+    # allowed to fail in the meantime (Windows .zip packaging is a known
+    # follow-up — see RP-4 Windows tracking ticket). When Windows succeeds
+    # the .zip is attached automatically via the files glob below; when it
+    # fails, the release ships with 6 of 8 assets (Linux + macOS + GPU
+    # tarballs and their sha256s).
+    if: |
+      github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+      && !contains(github.ref_name, '-')
+      && needs.build-cli-linux-cpu.result == 'success'
+      && needs.build-cli-linux-gpu.result == 'success'
+      && needs.build-cli-macos-arm64.result == 'success'
     needs:
       - build-cli-linux-cpu
       - build-cli-linux-gpu
@@ -824,7 +836,11 @@ jobs:
 
       - uses: softprops/action-gh-release@v2
         with:
-          fail_on_unmatched_files: true
+          # Soft-fail when Windows tarball is missing — see job-level if
+          # gate above. When build-cli-windows starts succeeding, the
+          # glob picks up the .zip automatically; for now the 6 reliable
+          # assets ship.
+          fail_on_unmatched_files: false
           files: |
             dist/sparrow-engine-cpu-*-linux-x86_64.tar.gz
             dist/sparrow-engine-cpu-*-linux-x86_64.tar.gz.sha256