ci: speed up publish workflow

[NathanFlurry]

What changed

• Removes accidental native Cargo rebuilds from the npm TypeScript publish path.
• Commits the generated actor action TypeScript file instead of regenerating it during package builds.
• Fixes the WASM command Rust cache path.
• Moves Linux native sidecar/plugin builds into a cached Docker/BuildKit path, matching the Darwin build style.
• Adds BuildKit/GHA cache mounts for native Cargo builds, including rusty_v8 on Linux.
• Restores Turbo dependency ordering for runtime-core and keeps generated/copied outputs modeled.
• Adds release artifact safety checks for executable bits and Darwin architecture.

Why

The previous publish run spent most of its critical path in work that looked like TypeScript but was actually cold native Rust compilation, plus a WASM cache path that did not restore Cargo target output.

Validation

• Workflow YAML parsed for .github/workflows/publish.yaml and .github/workflows/ci.yml.
• docker buildx build --check passed for Linux and Darwin native Dockerfiles.
• Turbo dry-run shows @rivet-dev/agentos dependency ordering restored and native meta builds skippable.
• Focused checks and final diff artifacts saved under ~/progress/agent-os/2026-07-08-gh-actions-ci-speed/.

Notes

A full local Turbo build is still blocked by an existing local npm shim issue while packing registry packages (npm@11.18.0 path missing), so the real proof should come from the preview publish workflow run.

[railway-app]

🚅 Deployed to the agentos-pr-1669 environment in agentos

Service	Status	Web	Updated (UTC)
agentos	😴 Sleeping (View Logs)	Web	Jul 9, 2026 at 4:15 am

---

🚅 Environment agentos-pr-1669 in rivet-frontend has no services deployed.