ci: the container gate and the version parse move into a compiled tool

tools/release.zig

@@ -717,8 +717,14 @@ fn runnerTemp(ctx: *Ctx) []const u8 {
 }
 
 /// A fresh directory under `RUNNER_TEMP`, named so `scrub` can find it. The name
-/// is claimed by an exclusive `makeDir` rather than by a random suffix: a
-/// collision is a retry, not a silent share.
+/// is claimed by an exclusive create rather than by a random suffix: a collision
+/// is a retry, not a silent share.
+///
+/// `createDirPathStatus`, not `createDirPath`, because the latter has `mkdir -p`
+/// semantics — it succeeds on a directory that is already there and never
+/// reports `error.PathAlreadyExists`, which made the retry below dead code. This
+/// program then adopted a stale or concurrently-held directory, wrote the
+/// signing material into it, and deleted the whole tree on the way out.
 fn makeTempDir(ctx: *Ctx, prefix: []const u8) ![]const u8 {
     const base = runnerTemp(ctx);
     var attempt: usize = 0;
@@ -726,10 +732,8 @@ fn makeTempDir(ctx: *Ctx, prefix: []const u8) ![]const u8 {
         const path = ctx.fmt("{s}/{s}.{s}-{d}", .{
             base, prefix, ctx.get("GITHUB_RUN_ID"), attempt,
         });
-        Io.Dir.cwd().createDirPath(ctx.io, path) catch |err| switch (err) {
-            error.PathAlreadyExists => continue,
-            else => return err,
-        };
+        const status = try Io.Dir.cwd().createDirPathStatus(ctx.io, path, .default_dir);
+        if (status == .existed) continue;
         var dir = try Io.Dir.cwd().openDir(ctx.io, path, .{ .iterate = true });
         defer dir.close(ctx.io);
         try dir.setPermissions(ctx.io, .fromMode(0o700));