fix(release): restore qualified runtime before the npm canary

The published-package verifier imports contracts from dist in the release checkout. Restore the exact qualification run's runtime artifact before publication so those dependencies are available without rebuilding the package.

.github/workflows/release.yml

@@ -337,6 +337,12 @@ jobs:
         id: package
         run: node scripts/ci/verified-package.mjs validate .cache/verified-package
 
+      - name: Restore qualified verifier runtime
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: rea-test-runtime
+          path: .
+
       - name: Publish
         shell: bash
         env:

tests/boundary/filesystem/releaseWorkflow.test.ts

@@ -664,7 +664,7 @@ it("requires qualified package validation before publishing and retains the regi
     .object({
       jobs: z.object({
         publish: z.object({
-          steps: z.array(z.object({ run: z.string().optional() })),
+          steps: z.array(stepSchema),
         }),
       }),
     })
@@ -685,6 +685,16 @@ it("requires qualified package validation before publishing and retains the regi
   );
   expect(verify).toBeGreaterThanOrEqual(0);
   expect(publish).toBeGreaterThan(verify);
+  const steps = workflow.jobs.publish.steps;
+  const runtime = steps.findIndex(
+    (step) => step.with?.name === "rea-test-runtime",
+  );
+  expect(runtime).toBeGreaterThan(verify);
+  expect(runtime).toBeLessThan(publish);
+  expect(steps[runtime]?.uses).toBe(
+    "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093",
+  );
+  expect(steps[runtime]?.with).toEqual({ name: "rea-test-runtime", path: "." });
   expect(
     commands
       .slice(publish + 1)