Releases: sync endpoint reports whether the named version is registered

[adamshiervani]

The counts in the sync response cover every version scanned, so a caller that named a version could not tell whether that version was registered. created: 1 can be a different release. The response now answers that directly.

POST /releases/sync  { "type": "mini", "version": "0.5.3" }

200 { "created": 1, "already-synced": 73, ..., "registered": true }
200 { "created": 0, ...,                     "registered": false }   # not on R2, no artifacts

registered is whether a row for the named version exists once the run is over, whichever run created it. A bare call, with no body, answers with the counts only.

 Sync(runner)
   parse body → settled
   stats = runner({ settled })
   "busy" → 409
+  if settled
+    registered = releaseExists(settled.type, settled.version)   # exported from release-sync
+    → { ...stats, registered }
   → stats

The release workflow in kvm-mini fails its job on registered: false.

---

Note

Low Risk
Additive API field on an optional sync body path; behavior for unsettled sync and core sync logic is unchanged aside from one extra DB lookup after named-version runs.

Overview
When POST /releases/sync is called with { type, version }, the JSON response now includes registered: whether a DB row for that exact version exists after the run finishes. Aggregate counts like created can refer to other versions scanned in the same run, so this field lets upload workflows (e.g. kvm-mini) fail clearly when the vouched release never landed.

Bare sync calls (no body) still return only the outcome counts—no registered field. releaseExists is exported from release-sync and used by the Sync handler for the post-run check.

^{Reviewed by Cursor Bugbot for commit ead931b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[adamshiervani]

Not needed: the release script validates the artifact layout before upload, and the tick retries anyway. The workflow checks HTTP 200 only.