Per-distribution uploads to prefix.dev and/or anaconda.org; humble off robostack-staging

[Tobias-Fischer]

Each distribution now uploads to its channel on the servers upload_to in its distro.yaml lists, with the same channel name on each. As agreed with prefix.dev for now:

Distribution	upload_to	read_from
lyrical	prefix.dev, anaconda.org	prefix.dev
rolling	prefix.dev	prefix.dev
jazzy	anaconda.org (prefix.dev mirrors it)	anaconda.org
humble	anaconda.org (prefix.dev mirrors it)	anaconda.org

This replaces the hourly robostack-staging → robostack-humble copy (copy-staging-packages.yml in robostack.github.io) for humble, and is the step towards retiring robostack-staging.

What changes:

• tools/robostack.py upload():
  • prefix.dev as before (trusted publishing, attestation, --skip-existing);
  • anaconda.org with rattler-build upload anaconda -o <channel>, using each distribution's own token: the repository secret ANACONDA_API_TOKEN_<DISTRO>, which its generated build.yaml passes to the upload as ANACONDA_API_TOKEN (vinca-gha's secrets.ANACONDA_API_TOKEN is rewritten per distribution instead of stripped).
  • rattler-build's anaconda upload has no --skip-existing, so files anaconda.org already has (checked through api.anaconda.org/dist/…) are skipped, which keeps re-runs idempotent.
  • Each upload is retried up to three times; a missing token fails the upload step with a clear message.
• ROBOSTACK_UPLOAD_CHANNEL (test channel) still uploads to that one prefix.dev channel only, and none still skips uploads.
• distro.yaml:
  • upload_to is new (default: both);
  • upload_target becomes read_from (prefix | anaconda), which only says where the builds look up what's already published (skip-existing, released_builds, the stale check, the ABI check);
  • humble: channel_name: robostack-staging → robostack-humble.
  • rs check validates both keys, and new-distro copies them.
• README: channel table and the new credentials.
• Tests: test_upload.py (both servers, anaconda.org only, skip-existing on anaconda.org, the test-channel override, a missing token) and test_generate_gha.py (each distribution's workflow uses its own secret).

pixi run rs check and the tool tests pass. Nothing was uploaded: the upload path hasn't run against the real channels yet, so the first post-merge build is its real test.

Set up (done): the anaconda.org organization robostack-lyrical; the repository secrets ANACONDA_API_TOKEN_HUMBLE, ANACONDA_API_TOKEN_JAZZY and ANACONDA_API_TOKEN_LYRICAL (each its organization's token, scope api:write); prefix.dev Repository Access for this repository's build.yaml on robostack-lyrical and robostack-rolling. rolling uploads to prefix.dev only, so it needs no anaconda.org token.

After merging:

• Remove humble's job from copy-staging-packages.yml in robostack.github.io.
• noetic still uploads to robostack-staging and is copied to robostack-noetic by the same workflow, so the workflow, the script and robostack-staging can only go once noetic uploads to robostack-noetic directly (its own repository).
• Moving humble or jazzy to prefix.dev later only needs upload_to/read_from in their distro.yaml, once prefix.dev's mirrors of them become regular channels.

Merge before the rosdistro syncs, at least before lyrical's (#60): its full rebuild then uploads every lyrical package to the new robostack-lyrical on anaconda.org too. Merged after it, those packages would already be on prefix.dev, the builds would skip them, and anaconda.org would only get later builds. The syncs then get a trivial conflict in distro.yaml (this PR's channel lines next to their pinning line). CI is held with [skip ci]: this touches shared tooling, so a CI run would build every distribution.

🤖 Generated with Claude Code

[Tobias-Fischer]

This is ready for review :)