[Tooling] Upload CDN builds as Internal first, publish as External later

[iangmaia]

Related issues

• Fixes AINFRA-2102
• Depends on Add update_apps_cdn_build_metadata action wordpress-mobile/release-toolkit#701 (update_apps_cdn_build_metadata action with batch post_ids support)
• Supersedes [Tooling] Upload CDN builds as internal first, publish as external later #2689 (same approach, cleaned up) and [Tooling] Upload CDN builds as drafts, publish in publish_release #2695 (draft-based approach, abandoned)

How AI was used in this PR

Claude Code was used to implement the Fastfile changes based on the approach designed in #2689 and refined through PR discussion in #2695. All generated code was reviewed.

Proposed Changes

• Upload all CDN build artifacts with visibility: :internal (Automatticians-only) during finalize_release / distribute_release_build, instead of external
• Embed CDN post IDs as an HTML comment (<!-- CDN_POST_IDS:{...} -->) in the draft GitHub release body so they can be retrieved later
• In publish_release, read the draft release body, extract post IDs, and call update_apps_cdn_build_metadata to flip visibility to external before publishing the GitHub release
• This gives the team a window for internal testing between finalize and publish

Why visibility instead of draft status?

An earlier approach (#2695) used post_status: 'draft' instead of visibility: :internal. This was abandoned because:

• Draft posts on the CDN may not be easily downloadable/testable by the Release Manager
• Internal visibility keeps builds accessible to Automatticians for smoke-testing
• Storing post IDs in the GitHub release body is more deterministic than querying the CDN API for drafts (only publishes builds from the last finalization, even if finalize_release ran multiple times)

Testing Instructions

• Full end-to-end testing will happen during the next release cycle
• The internal→external visibility flow was manually verified against the real CDN API (via release-toolkit PR Studio: Fix SearchControl margin bottom styles to ensure compatibility with the new component version #701)

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

🤖 Generated with Claude Code