Replaces scripts/release/publish.sh — uploads built tarballs to a GitHub release tagged otp-<hash>. The release is created if it doesn't exist; existing assets with matching names are deleted before upload (gh release upload won't replace by default).

Why this module carries the most error categories

Of the five MobDev.Release.* orchestrators this is the one most likely to fail through no fault of ours — GitHub goes down, gh auth expires, the local network drops. The shell version of this step blobs all of those together as exit 1; the user can't tell whether it's their problem or ours. This module classifies every gh failure into one of:

• :auth_required — gh CLI isn't authenticated, or token lacks repo scope. Hint suggests gh auth login --scopes "repo,write:packages".
• :infra_unreachable — GitHub returned 5xx or the network's down. Detail carries the first line of gh's stderr so it's obvious what to check on status.github.com.
• :precondition_failed — no tarballs in out_dir matching hash. Hint points the user at mix mob.release.tarball all.
• :cmd_failed — fallback for unexpected gh failures (e.g. malformed tag, write permission denied on a non-our repo).

This is exactly the "is GitHub down or am I broken?" distinction the build-system migration plan called for. Test coverage exercises each category against a representative gh stderr snippet.

Public API

MobDev.Release.Publish.publish()                    # defaults
MobDev.Release.Publish.publish(repo: "fork/mob")    # publish to fork
MobDev.Release.Publish.publish(assets: ["otp-android"])  # subset

Returns {:ok, %{tag, repo, assets}} on success or a tagged error.

What it does end-to-end

1. Resolve repo, hash, out_dir (env or opts).
2. Discover which of the four canonical tarball basenames are present in out_dir for this hash. At least one must exist.
3. gh release view otp-<hash> — exists?
   • If not (release not found), gh release create.
   • If 401/403, :auth_required.
   • If 5xx/network, :infra_unreachable.
4. List the release's existing assets. For each one that overlaps with what we're about to upload, gh release delete-asset.
5. Single gh release upload otp-<hash> <paths…>.
6. Verify by re-listing assets — returned in info.assets.