feat(release): let publish-store take a lane's binary from a release

[grimen]

What and why

publish-store.yml hands a lane whatever artifacts downloads, and download-artifact only sees the current run. A promotion tier builds nothing. So a store with no promote endpoint, like Huawei AppGallery, which re-uploads the bundle on every tier, has nothing to read.

The template answers with an extra huawei-binary job, identical in its beta and production callers. The job runs gh release download "$TAG" --pattern '*.aab', uploads the result as an artifact, and points the lane at every artifact (artifacts: "*").

Two inputs replace that job:

• release-assets: a glob of assets to download from the release-tag release into the same $WORKFLOWS_ASSETS_DIR as artifacts, after them, so the lane finds the file the same way.
• release-tag: the release they come from; required when release-assets is set.
• scripts/release/release-assets-fetch.sh (new) does the download.
  • A missing tag is fatal, and names the input and the fix (die_fix, linking the guide).
  • No matching asset, or a broken download, is fatal with gh's own reason: a lane run without its binary uploads nothing.
  • It reports the files it brought.

Not breaking: two new inputs that default to empty, and a step that only runs when release-assets is set.

How to verify

• make check passes: exit 0.
• test/release-assets-fetch.bats (new, 6 cases):
  • the matching assets land and are named, and the exact gh arguments are checked;
  • a new directory is created;
  • files already there (from artifacts) are left alone and not reported;
  • no tag is fatal and names the fix, with no gh call;
  • no matching asset is fatal, with gh's reason;
  • a missing pattern or directory prints the usage.
• test/workflow-shape.bats, new case: both inputs default to empty, and the step:
  • is gated on release-assets;
  • reads both inputs;
  • lands in $WORKFLOWS_ASSETS_DIR;
  • runs after Setup and the artifact download, and before the lane.
• test/consumer-contract.bats: both inputs are documented in the guide's publish-store.yml table.

Docs

• docs/consumer-guide.md: release-assets and release-tag rows in the publish-store.yml table, with the AppGallery example.
• README.md: the script, shell-script, bats-file and test counts.

The template drops both huawei-binary jobs, passing release-assets: '*.aab' and release-tag to its Huawei calls, after it moves its pin to the release carrying this.

Checklist

• PR title is a Conventional Commit with a valid scope
• make check passes locally
• Every behaviour this PR adds is tested here (test/release-assets-fetch.bats, test/workflow-shape.bats)
• The script has its own test file that runs it and covers each exit path
• docs/consumer-guide.md updated: two new inputs
• Not breaking