fix(release): a shared storage quota no longer takes down every nightly

[rynfar]

Every scheduled release since 2026-08-11 has failed with:

##[error]Failed to CreateArtifact: Artifact storage quota has been hit.

Actions storage is an org-wide quota billed by GB-hour. Per the billing API this org is at 1,488 GB-hours ≈ 2.04 GB-month against the 2.00 GB its plan includes, with net spend at $0.00 — so GitHub hard-blocks uploads rather than billing four cents of overage. Two release jobs (Resolve T3 Connect public config, Build WSL node-pty) treated that upload as fatal, and losing them skipped the entire build matrix, the npm publish, the GitHub release, and the Discord announce.

ci.yml already learned this lesson after PR #9 and made its upload continue-on-error. The release workflow never got the same treatment.

What changed

Tracing config degrades instead of failing. Connect is already optional here — the surrounding comments say the desktop apps build and auto-update without it. The upload and all three downloads are now best-effort, and the loader distinguishes a missing artifact from a Connect-less setup, emitting a ::warning:: on the former so a silently untraced production build doesn't look identical to a healthy one. It stays an artifact rather than becoming a job output because it carries T3CODE_RELAY_CLIENT_OTLP_TRACES_TOKEN, which the loader has to ::add-mask::.

A concurrency group, which the workflow had none of. When Blacksmith had no Ubuntu capacity from 08-03 to 08-06, 23 nightly runs stacked up instead of superseding each other and sat ~480 VM-hours waiting for runners that never arrived — each dying at GitHub's 24h queue cap with runner_name: "" and steps: 0.

timeout-minutes does not help here; it only counts execution time. Proof from this repo's own history: Mobile Native Static Analysis has timeout-minutes: 10 and still sat queued for 262 minutes on 08-12.

Nightlies now share one group. Tag releases and manual dispatches key off run_id so they stay unique and are never cancelled — losing a real release to a scheduling race is far worse than paying for a duplicate build.

Retention. resource-monitor-* drops from 7 days to 1, the only release artifact held above the minimum, and it's consumed within the same run.

Note

This reduces the blast radius; it does not restore nightlies on its own. The org's Actions spending limit still needs raising above $0 — that's a billing setting, not a code change.

Verification

actionlint reports 13 findings before and after, identical categories and counts — all pre-existing (custom Blacksmith runner labels, run_started_at, SC2129 style). No new findings introduced. Workflow YAML re-parsed and structurally checked; vp fmt clean.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 30d499a.

This comment will update automatically after the next completed run.