Harden release publishing and document release blockers

tools/publish_release.sh

@@ -106,6 +106,10 @@ for f in "${all_artifacts[@]}"; do
 done
 echo "==> Checksums written to $checksum_file"
 cat "$checksum_file"
+if [[ "${PUBLISH_DRY_RUN:-0}" == "1" ]]; then
+  echo "DRY RUN: preflight and checksums passed; no release or upload was created."
+  exit 0
+fi
 
 API="$HOST/api/v1/repos/$REPO/releases"
 created_release=0