Inline publish artifact download to avoid repo checkout drift

Using direct gh artifact download in publish jobs keeps release uploads tied to the selected run ID and avoids behavior changes from repository state at run time.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: cpcloud

.github/workflows/release-cuda-pathfinder.yml

@@ -266,13 +266,30 @@ jobs:
     env:
       RUN_ID: ${{ needs.prepare.outputs.run-id }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-
       - name: Download wheels
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          ./ci/tools/download-wheels "${RUN_ID}" "cuda-pathfinder" "${{ github.repository }}" "dist"
+          # Intentionally inline artifact download logic here so publish jobs
+          # are pinned only to RUN_ID artifacts and do not depend on repo checkout.
+          mkdir -p dist
+          gh run download "${RUN_ID}" -p "cuda-pathfinder*" -R "${{ github.repository }}"
+          shopt -s nullglob globstar
+          for artifact_dir in cuda-*; do
+            if [[ ! -d "${artifact_dir}" ]]; then
+              continue
+            fi
+            if [[ "${artifact_dir}" == *-tests ]]; then
+              echo "Skipping test artifact: ${artifact_dir}"
+              continue
+            fi
+            wheels=( "${artifact_dir}"/**/*.whl )
+            if (( ${#wheels[@]} > 0 )); then
+              mv "${wheels[@]}" dist/
+            fi
+          done
+          rm -rf cuda-*
+          ls -la dist
 
       - name: Publish to TestPyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
@@ -327,13 +344,30 @@ jobs:
     env:
       RUN_ID: ${{ needs.prepare.outputs.run-id }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-
       - name: Download wheels
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          ./ci/tools/download-wheels "${RUN_ID}" "cuda-pathfinder" "${{ github.repository }}" "dist"
+          # Intentionally inline artifact download logic here so publish jobs
+          # are pinned only to RUN_ID artifacts and do not depend on repo checkout.
+          mkdir -p dist
+          gh run download "${RUN_ID}" -p "cuda-pathfinder*" -R "${{ github.repository }}"
+          shopt -s nullglob globstar
+          for artifact_dir in cuda-*; do
+            if [[ ! -d "${artifact_dir}" ]]; then
+              continue
+            fi
+            if [[ "${artifact_dir}" == *-tests ]]; then
+              echo "Skipping test artifact: ${artifact_dir}"
+              continue
+            fi
+            wheels=( "${artifact_dir}"/**/*.whl )
+            if (( ${#wheels[@]} > 0 )); then
+              mv "${wheels[@]}" dist/
+            fi
+          done
+          rm -rf cuda-*
+          ls -la dist
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0