ci: publish Snap edge builds

[roshanjonah]

Summary

• add a Snap GitHub Actions workflow that builds amd64 and arm64 snaps
• publish successful main-branch builds to the Snap Store edge channel only
• document scoped SNAPCRAFT_STORE_CREDENTIALS setup and keep stable promotion manual
• add a static workflow guardrail test to the root build

Verification

• pnpm install --frozen-lockfile
• pnpm test:snap-workflow
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/snap.yml"); puts "yaml ok"'\n- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/snap.yml\n- git diff --check\n\n## Sources\n- snapcore/action-build README: path input and snap output\n- snapcore/action-publish README: SNAPCRAFT_STORE_CREDENTIALS and edge release\n- GitHub Actions workflow syntax and hosted runner docs\n

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 570a86a489

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scope Snap Store credentials only to publishing

Because this secret is defined at job scope, every step receives SNAPCRAFT_STORE_CREDENTIALS, including the Snapcraft build that runs PR-controlled snap/** contents. For same-repository PRs or any merged change to snap/snapcraft.yaml, an override-build/build script can read and exfiltrate the store login before the publish-only if guard is evaluated, so the credential should be passed only to the publish/credential-check path rather than the whole job.

Useful? React with 👍 / 👎.