ci: store release build artifacts in GCS via OIDC

[devin-ai-integration]

Summary

Moves the Release workflow's cross-job build artifacts off GitHub Actions artifact storage and into the repository-isolated EvalOps GCS bucket, authenticated via GitHub OIDC / Workload Identity Federation (no static keys). This is the bulk of this repo's Actions storage, since it's almost entirely per-arch release tarballs handed between jobs.

Adds a ./.github/actions/gcs-artifacts composite action (upload/download via google-github-actions/auth + gcloud storage) defaulting to this repo's dedicated identity:

bucket:          gs://evalops-prod-browser-use-rs-ci-evidence
service-account: browser-use-rs-ci-evidence@evalops-prod.iam.gserviceaccount.com

Workflow rewiring in .github/workflows/release.yml:

 build-binary (matrix: linux, macos):
+  permissions: { contents: read, id-token: write }
-  actions/upload-artifact  name=browser-use-rs-<label>  path=dist/*.tar.gz
+  gcs-artifacts upload  prefix=browser-use-rs/release/${run_id}/binaries  paths=dist/*.tar.gz

 publish-release:
+  permissions: { contents: write, id-token: write }
-  actions/download-artifact  pattern=browser-use-rs-*  merge-multiple  path=dist
+  gcs-artifacts download  prefix=browser-use-rs/release/${run_id}/binaries  destination=dist
-  actions/upload-artifact  name=browser-use-rs-release  (tarballs/SHA256SUMS/formula/notes)
+  gcs-artifacts upload  prefix=browser-use-rs/release/${run_id}/release-bundle  paths=<same set>

Notes:

• Prefixes key on github.run_id only (not run_attempt), so "Re-run failed jobs" on publish-release still resolves the binaries the build matrix produced. Matrix legs stay collision-safe because each uploads a distinct target-specific tarball name (browser-use-rs-<tag>-<target>.tar.gz); download flattens by basename, preserving the old merge-multiple layout in dist/.
• id-token: write is job-scoped (only on the two jobs that touch GCS); prepare-release keeps the workflow-level contents: write it needs to push the tag.
• The actual GitHub Release assets (softprops/action-gh-release) and Homebrew tap publish are unchanged — only the redundant Actions-artifact copies moved.

Dependency / ordering

This repo is not yet authorized for the shared WIF setup. It requires evalops/deploy#8125 to merge and a terraform apply (creates the browser-use-rs-ci-evidence SA, bucket, and repo-scoped WIF binding), plus the GCP_WORKLOAD_IDENTITY_PROVIDER repo var/secret, before these GCS steps can authenticate. Until then a real release run's GCS steps will fail auth.

Test Plan

• actionlint .github/workflows/release.yml — passed.
• bash -n on the extracted composite-action transfer script — passed.
• No Rust product code changed; on.push.paths for release.yml excludes .github/workflows/** and release-version.py already lists release.yml as release-automation (non-release-worthy), so this change does not itself cut a release.
• Live GCS auth not verified — depends on the deploy terraform apply above.

Link to Devin session: https://app.devin.ai/sessions/63e9fd3ecd3a42e2bd9a3e665fa1a6b1
Requested by: @haasonsaas

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring