release: guard against phantom (0-asset) releases

Add a verify-assets job that fails the release run if the published
Release carries zero assets, so a build/pack failure across every target
can never surface as a real release (or notify downstream) unnoticed.
Wire it after the build matrix; downstream notify now needs it too.

Author: matthew

.github/workflows/release.yml

@@ -167,14 +167,44 @@ jobs:
         with:
           subject-path: "plugin-dist/*.tar.gz"
 
+  # PHANTOM-RELEASE GUARD: assert the published Release actually carries assets before we treat this
+  # as a real release. The per-target build/upload jobs run with fail-fast:false, and `create-release`
+  # always makes the (initially empty) Release up front — so a build/pack failure on EVERY target
+  # (e.g. a stale Cargo.lock tripping `--locked`) leaves a tag + Release with ZERO assets: a "phantom"
+  # that silently breaks busbar's plugin-registry-gate. This job fails the whole release run loud if
+  # assets == 0, so a phantom can never ship (or notify downstream) unnoticed. It depends on the build
+  # matrix but does NOT inherit its fail-fast:false — one green target is enough to have assets, but
+  # zero across the board must hard-fail here.
+  verify-assets:
+    needs: [auth-plugin]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert the Release has at least one asset
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          count="$(gh release view "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --json assets --jq '.assets | length')"
+          echo "Release ${GITHUB_REF_NAME} has ${count} asset(s)."
+          if [ "${count}" -eq 0 ]; then
+            echo "::error::PHANTOM RELEASE: ${GITHUB_REF_NAME} was published with 0 assets." \
+                 "Every build/pack target failed to upload a tarball. Failing the release run so this" \
+                 "tag is not mistaken for a real release by busbar's plugin-registry-gate. Fix the" \
+                 "build (check Cargo.lock freshness vs --locked and the plugin cdylib build step)," \
+                 "delete this tag+release, and re-cut." >&2
+            exit 1
+          fi
+
   # Instant marketing-site rebuild the moment this plugin ships a real release -- marketing's
   # deploy.yml listens for this exact repository_dispatch event type (plus its own daily-poll
   # fallback, so a missed/failed dispatch here is never a permanent gap). Same RELEASE_DISPATCH_TOKEN
   # pattern busbar core's own release.yml uses for its downstream fan-out -- see that file's
   # notify-downstream job for the template this mirrors. Fails loud (not a silent no-op) if the
   # secret isn't provisioned, so a missing secret can't masquerade as "nothing to notify."
   notify-marketing:
-    needs: [auth-plugin]
+    needs: [auth-plugin, verify-assets]
     runs-on: ubuntu-latest
     steps:
       - name: Dispatch upstream-release to the marketing site