release: move publication orchestration into tools/release.zig, pin rotated subkey

build.zig

@@ -218,6 +218,27 @@ pub fn build(b: *std.Build) void {
     b.step("test-aarch64", "Run the test suite for aarch64-linux-musl (use -fqemu)")
         .dependOn(&aarch64_run.step);
 
+    // The release publication tool (milestone-14 deviation 24). It is a host
+    // tool like `dist_stage` and `verify_dist`, and it is installed rather than
+    // run from the build graph: the workflow invokes it once per phase with the
+    // secrets in its environment, and a Run step would have to carry them.
+    const release_tool = hostTool(b, "release");
+    b.step("release-tool", "Install the release publication tool into zig-out/bin")
+        .dependOn(&b.addInstallArtifact(release_tool, .{}).step);
+
+    // Its pure decisions — semver ordering, VALIDSIG field selection, changelog
+    // extraction, the releases-payload shape guard — are the reason it exists,
+    // so they run in the same `zig build test` as everything else.
+    const release_tests = b.addTest(.{
+        .name = "release-tool",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("tools/release.zig"),
+            .target = b.graph.host,
+            .optimize = optimize,
+        }),
+    });
+    test_step.dependOn(&b.addRunArtifact(release_tests).step);
+
     addDist(b, options, web_assets, .{
         .version = version_option,
         .version_string = version_string,