fix: add post-publish-matrix-retry to release workflow

Mirrors the retry pattern from nightly.yml: uploads a pass-marker
artifact per Python version, then a retry job downloads the marker
and skips versions that already passed. Only fires when the primary
post-publish-matrix job fails or is cancelled.

Signed-off-by: jgstern-agent <josh-agent@iterabloom.com>

Author: jgstern-agent

.ci/affected-tests.txt

@@ -1,5 +1,5 @@
 # Test selection manifest
-# Generated by smart-test at 2026-03-12T18:10:01-04:00
+# Generated by smart-test at 2026-03-12T18:58:57-04:00
 # Mode: targeted
 # Baseline: b9148d0e3f989729c11028870100ac7e337bb59c
 # Reason: no Python source files changed

.github/workflows/release.yml

@@ -376,6 +376,130 @@ jobs:
               --cov-config=.coveragerc.no-embeddings $TEST_PATHS
           fi
 
+      - name: Mark version as passed
+        if: success()
+        run: |
+          mkdir -p /tmp/matrix-result
+          echo "passed" > /tmp/matrix-result/py${{ matrix.python-version }}
+
+      - name: Upload pass marker
+        if: success()
+        uses: actions/upload-artifact@v3
+        with:
+          name: post-publish-pass-py${{ matrix.python-version }}
+          path: /tmp/matrix-result/py${{ matrix.python-version }}
+          retention-days: 1
+
+  # ─────────────────────────────────────────────────────────────
+  # Post-publish test matrix retry (handles transient infra failures)
+  # Only retries Python versions where the primary job failed.
+  # ─────────────────────────────────────────────────────────────
+  post-publish-matrix-retry:
+    needs: [check-nightly, build-and-publish, post-publish-matrix]
+    if: >-
+      always() &&
+      needs.build-and-publish.result == 'success' &&
+      needs.check-nightly.outputs.matrix_covered != 'true' &&
+      (needs.post-publish-matrix.result == 'failure' || needs.post-publish-matrix.result == 'cancelled')
+    strategy:
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+      fail-fast: false
+
+    runs-on: self-hosted
+    container: python:${{ matrix.python-version }}-bookworm
+    timeout-minutes: 15
+    env:
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+
+    steps:
+      - name: Download pass marker
+        id: check-primary
+        uses: actions/download-artifact@v3
+        with:
+          name: post-publish-pass-py${{ matrix.python-version }}
+          path: /tmp/matrix-result
+        continue-on-error: true
+
+      - name: Skip if primary passed
+        id: skip-check
+        run: |
+          if [ -f /tmp/matrix-result/py${{ matrix.python-version }} ]; then
+            echo "Primary job passed for Python ${{ matrix.python-version }} — skipping retry"
+            echo "should_skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Primary job failed for Python ${{ matrix.python-version }} — retrying"
+            echo "should_skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install Node.js for JS-based actions
+        if: steps.skip-check.outputs.should_skip != 'true'
+        run: apt-get update && apt-get install -y nodejs
+
+      - uses: actions/checkout@v4
+        if: steps.skip-check.outputs.should_skip != 'true'
+
+      - name: Install dependencies
+        if: steps.skip-check.outputs.should_skip != 'true'
+        run: |
+          pip install --upgrade pip
+          if [ -d "packages/hypergumbo-core" ]; then
+            pip install pytest pytest-cov pytest-xdist jsonschema
+            pip install -e packages/hypergumbo-core \
+                        -e packages/hypergumbo-lang-mainstream \
+                        -e packages/hypergumbo-lang-common \
+                        -e packages/hypergumbo-lang-extended1 \
+                        -e "packages/hypergumbo-tracker[dev,tui]" \
+                        -e packages/hypergumbo
+          else
+            pip install -e .[dev]
+          fi
+
+      - name: Build source-only grammars
+        if: steps.skip-check.outputs.should_skip != 'true'
+        run: ./scripts/build-source-grammars
+
+      - name: Check for sentence-transformers
+        if: steps.skip-check.outputs.should_skip != 'true'
+        run: |
+          if python -c "import sentence_transformers" 2>/dev/null; then
+            echo "sentence-transformers available"
+            echo "EMBEDDINGS_AVAILABLE=true" >> "$GITHUB_ENV"
+          else
+            echo "sentence-transformers not installed, embedding tests will be skipped"
+            echo "EMBEDDINGS_AVAILABLE=false" >> "$GITHUB_ENV"
+          fi
+
+      - name: Run tests with coverage
+        if: steps.skip-check.outputs.should_skip != 'true'
+        run: |
+          if [ -d "packages/hypergumbo-core" ]; then
+            COV_PATHS="--cov=packages/hypergumbo-core/src --cov=packages/hypergumbo-lang-mainstream/src --cov=packages/hypergumbo-lang-common/src --cov=packages/hypergumbo-lang-extended1/src --cov=packages/hypergumbo-tracker/src"
+            TEST_PATHS="packages/*/tests/"
+          else
+            COV_PATHS="--cov=src"
+            TEST_PATHS=""
+          fi
+
+          # Detect available CPUs from cgroup limits
+          if [ -f /sys/fs/cgroup/cpu.max ]; then
+            read quota period < /sys/fs/cgroup/cpu.max
+            if [ "$quota" != "max" ]; then
+              WORKERS=$((quota / period))
+            else
+              WORKERS=$(nproc)
+            fi
+          else
+            WORKERS=$(nproc)
+          fi
+
+          if [ "$EMBEDDINGS_AVAILABLE" = "true" ]; then
+            pytest -n "$WORKERS" $COV_PATHS --cov-report=term-missing --cov-fail-under=100 $TEST_PATHS
+          else
+            pytest -n "$WORKERS" $COV_PATHS --cov-report=term-missing --cov-fail-under=100 \
+              --cov-config=.coveragerc.no-embeddings $TEST_PATHS
+          fi
+
   # ─────────────────────────────────────────────────────────────
   # Post-publish integration tests (runs only if nightly didn't cover it)
   # ─────────────────────────────────────────────────────────────