Why

release.yml builds the 4 platform binaries and creates the GitHub Release, then does zero downstream publishing. The old publish-python-sdk.yml / publish-node-sdk.yml / update-homebrew.yml were deleted after v1.10.5 (#114, #122), so since 2026-05-20 a daemon release reaches none of PyPI / npm / Homebrew. PyPI is stuck at 1.10.5, npm at 1.10.2, the tap formula at 1.10.5.

What

Adds a publish-downstream job (needs: release, skipped for -rc/-beta) that fans the current tag's version out to all three channels. Each leg is independent (continue-on-error) so one failing channel doesn't block the others; a final gate step surfaces any failure and fails the job.

• PyPI / npm: gh workflow run publish.yml against pilot-protocol/sdk-python and pilot-protocol/sdk-node with -f version=${TAG#v}. The companion PRs (sdk-python#14, sdk-node#12) add the version input + version-pinning so the SDKs publish version-locked to the daemon, not to stale source. Uses a cross-repo PAT RELEASE_DISPATCH_TOKEN (a GitHub-Release created by GITHUB_TOKEN cannot trigger downstream on: release workflows, and GITHUB_TOKEN has no scope on sibling repos).
• Homebrew: restores the original update-homebrew.yml logic inline — downloads this release's checksums.txt, regenerates Formula/pilotprotocol.rb, and pushes it to TeoSlayer/homebrew-pilot via HOMEBREW_TAP_TOKEN.

Secrets required (NOT yet present in this repo)

• RELEASE_DISPATCH_TOKEN — PAT with repo + workflow scope, able to dispatch workflows in pilot-protocol/sdk-node and pilot-protocol/sdk-python.
• HOMEBREW_TAP_TOKEN — PAT with repo (contents:write) on TeoSlayer/homebrew-pilot.

NPM_TOKEN / PYPI_API_TOKEN already exist in the SDK repos and are used there.