[neriousy]

Resumes submitting the WinGet manifests to microsoft/winget-pkgs, paused in #56262 until the packages were accepted. Both are in now: Anomaly.OpenCode and Anomaly.OpenCode.Desktop 2.0.29 were merged (microsoft/winget-pkgs#452561, microsoft/winget-pkgs#452562).

The commented-out call in script/publish.ts went away with #59046, along with script/publish-winget.ts, so this ports the submission to the new release pipeline instead of uncommenting it:

• New .github/release/publish-winget.sh reads the manifests render-winget.sh already writes and opens one pull request per package from the WINGET_GITHUB_TOKEN owner's fork. It behaves like the old submit(): it skips versions already in winget-pkgs or with an existing PR, and reuses the branch left by a retried release.
• It only submits for stable (latest) releases that are not dry runs. Beta and dry runs still just render and upload the manifests.
• publish-winget runs in the release environment for stable releases (where WINGET_GITHUB_TOKEN lives, as in the old publish job). The Submit step is continue-on-error, so a WinGet rejection does not fail the release, which matches the old nothrow warning.
• release-dry-run.yml gets the same change to keep the copy in sync.

Before merging: confirm WINGET_GITHUB_TOKEN is still set in the release environment.

[opencodejr]

I found one ordering problem worth fixing before merge; apart from that, the port works and matches the old submit().

I ran publish-winget.sh on the manifests render-winget.sh writes, with a stubbed gh. Beta releases and dry runs are skipped. A missing token exits with an error, which continue-on-error absorbs. A stable release makes the same API calls as the old script (fork, existing-version and existing-PR checks, tree and commit from upstream master, the PATCH fallback for a branch left by a retry, one PR per package), with the correct manifests/a/Anomaly/OpenCode[/Desktop]/<version> paths. I didn't run the real workflow or touch the real GitHub API.

Public API: unchanged (CI and release scripts only).

Concern: publish-winget doesn't wait for the jobs that upload the installers its manifests point to, so the WinGet PRs can be opened, and fail validation, before the files exist. Details are inline.

[opencodejr]

The ordering problem from my last review is fixed. publish-winget now also waits for publish-cli and publish-desktop, so the WinGet PRs only open once the installers are on opencode.ai. On stable releases both jobs always run (the plan sets cli and desktop to true for latest), and a failure in either stops the submission. Nothing ran end to end, since that needs the release environment and the token.

Public API: unchanged (CI only).

Nothing new to raise.