fix(ci): unblock v1.20.5 release assets and Docker registry auth

Use rustup run stable for cargo-deb on self-hosted runners, run
create-release when sibling jobs fail via always(), tolerate missing
debian artifacts, and pass Terraphim registry credentials into Docker
builds via BuildKit secrets.

Author: Test User

.github/workflows/docker-multiarch.yml

@@ -40,6 +40,9 @@ on:
       OP_SERVICE_ACCOUNT_TOKEN:
         description: '1Password service account token'
         required: false
+      CARGO_REGISTRIES_TERRAPHIM_TOKEN:
+        description: 'Bearer token for the Terraphim Gitea cargo registry'
+        required: false
 
 env:
   REGISTRY: ghcr.io
@@ -197,6 +200,29 @@ jobs:
             org.opencontainers.image.vendor=Terraphim AI
             ubuntu.version=${{ matrix.ubuntu-version }}
 
+      - name: Prepare Terraphim cargo registry token for Docker build
+        id: cargo-registry-token
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          CARGO_REGISTRIES_TERRAPHIM_TOKEN: ${{ secrets.CARGO_REGISTRIES_TERRAPHIM_TOKEN }}
+        run: |
+          TOKEN=""
+          if [ -n "${CARGO_REGISTRIES_TERRAPHIM_TOKEN}" ]; then
+            TOKEN="${CARGO_REGISTRIES_TERRAPHIM_TOKEN}"
+          elif [ -n "${OP_SERVICE_ACCOUNT_TOKEN}" ]; then
+            GITEA_TOKEN="$(op read "op://TerraphimPlatform/gitea-test-token/credential" 2>/dev/null || true)"
+            if [ -n "${GITEA_TOKEN}" ]; then
+              TOKEN="Bearer ${GITEA_TOKEN}"
+            fi
+          fi
+          if [ -z "${TOKEN}" ]; then
+            echo "::error::Terraphim cargo registry token unavailable (set CARGO_REGISTRIES_TERRAPHIM_TOKEN or OP_SERVICE_ACCOUNT_TOKEN)"
+            exit 1
+          fi
+          echo "::add-mask::${TOKEN}"
+          printf '%s' "${TOKEN}" > "${RUNNER_TEMP}/cargo_registry_token"
+          echo "token_file=${RUNNER_TEMP}/cargo_registry_token" >> "${GITHUB_OUTPUT}"
+
       - name: Build and push to GHCR
         uses: docker/build-push-action@v7
         with:
@@ -209,6 +235,8 @@ jobs:
           build-args: |
             UBUNTU_VERSION=${{ matrix.ubuntu-version }}
             RUST_VERSION=1.92.0
+          secret-files: |
+            cargo_registry_token=${{ steps.cargo-registry-token.outputs.token_file }}
           no-cache: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -229,6 +257,8 @@ jobs:
           build-args: |
             UBUNTU_VERSION=${{ matrix.ubuntu-version }}
             RUST_VERSION=1.92.0
+          secret-files: |
+            cargo_registry_token=${{ steps.cargo-registry-token.outputs.token_file }}
           no-cache: true
           cache-from: type=gha
           provenance: false

.github/workflows/release-comprehensive.yml

@@ -430,7 +430,8 @@ jobs:
           if command -v cargo-deb &>/dev/null; then
             cargo-deb --version
           else
-            cargo install cargo-deb --version 3.1.1
+            # Self-hosted runners may alias `cargo` via rustup; use stable explicitly.
+            rustup run stable cargo install cargo-deb --locked --version 3.1.1
           fi
 
       - name: Cache dependencies
@@ -464,9 +465,8 @@ jobs:
       - name: Build Debian packages
         run: |
           # Clean terraphim_server to ensure fresh UI embedding
-          cargo clean -p terraphim_server
-          
-          cargo deb -p terraphim_server --output target/debian/
+          rustup run stable cargo clean -p terraphim_server
+          rustup run stable cargo deb -p terraphim_server --output target/debian/
 
       - name: Upload Debian packages
         uses: actions/upload-artifact@v5
@@ -600,9 +600,13 @@ jobs:
 
   create-release:
     name: Create GitHub release
-    needs: [verify-versions, verify-release-assets, build-binaries]
+    needs: [verify-versions, verify-release-assets, build-binaries, sign-and-notarize-macos]
     if: >-
+      always() &&
+      !cancelled() &&
       needs.verify-versions.result == 'success' &&
+      needs.build-binaries.result == 'success' &&
+      needs.sign-and-notarize-macos.result == 'success' &&
       needs.verify-release-assets.result == 'success'
     runs-on: ubuntu-latest
     permissions:
@@ -622,6 +626,7 @@ jobs:
       - name: Download Debian package artifacts
         uses: actions/download-artifact@v4
         id: download_debian
+        continue-on-error: true
         with:
           name: debian-packages
           path: release-assets

docker/Dockerfile.multiarch

@@ -116,6 +116,7 @@ WORKDIR /code
 
 # Copy the workspace pieces required to resolve local path dependencies.
 COPY Cargo.toml Cargo.lock ./
+COPY .cargo/config.toml .cargo/config.toml
 COPY crates ./crates
 COPY terraphim_server ./terraphim_server
 COPY terraphim_ai_nodejs ./terraphim_ai_nodejs
@@ -125,8 +126,10 @@ COPY terraphim_firecracker/Cargo.toml terraphim_firecracker/
 RUN rm -rf terraphim_server/dist && mkdir -p terraphim_server/dist
 COPY --from=frontend-builder /app/dist ./terraphim_server/dist
 
-# Build the application
-RUN . /root/.profile && \
+# Build the application (Terraphim registry auth via BuildKit secret)
+RUN --mount=type=secret,id=cargo_registry_token \
+    export CARGO_REGISTRIES_TERRAPHIM_TOKEN="$(cat /run/secrets/cargo_registry_token)" && \
+    . /root/.profile && \
     RUST_TARGET=$(cat /tmp/rust-target) && \
     cargo build --release --target=$RUST_TARGET --package terraphim_server