feat(lastcode): add resumable Intel builds

.github/workflows/lastcode-intel-artifact.yml

@@ -1,5 +1,7 @@
 name: LastCode Intel artifact
 
+run-name: Build Intel package · ${{ inputs.installable_tag }} · ${{ inputs.request_token }}
+
 on:
   workflow_dispatch:
     inputs:
@@ -11,6 +13,10 @@ on:
         description: Full commit SHA advertised for the installable tag
         required: true
         type: string
+      request_token:
+        description: Unique token used to correlate this dispatch to one workflow run
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -30,6 +36,7 @@ jobs:
     env:
       INSTALLABLE_TAG: ${{ inputs.installable_tag }}
       INSTALLABLE_COMMIT: ${{ inputs.installable_commit }}
+      REQUEST_TOKEN: ${{ inputs.request_token }}
     steps:
       - name: Checkout workflow automation
         uses: actions/checkout@v6
@@ -75,6 +82,10 @@ jobs:
             echo "installable_commit must be a full lowercase commit SHA." >&2
             exit 1
           fi
+          if [[ ! "$REQUEST_TOKEN" =~ ^intel-[0-9a-f-]{36}$ ]]; then
+            echo "request_token must be an intel-prefixed UUID." >&2
+            exit 1
+          fi
 
           git fetch --force --no-tags origin "refs/tags/${INSTALLABLE_TAG}:refs/tags/${INSTALLABLE_TAG}"
           resolved_commit="$(git rev-parse "${INSTALLABLE_TAG}^{commit}")"

docs/lastcode/release.md

@@ -121,11 +121,38 @@ until LastCode intentionally publishes compatible releases.
 
 ## Intel Build Publication
 
-The manually dispatched **LastCode Intel artifact** workflow accepts one exact
+The resumable **Build Intel package (macOS)** Project Action dispatches the manual
+**LastCode Intel artifact** workflow for one exact
 `lastcode/checkpoint/...` or `lastcode/revision/...` tag and its full advertised
 commit. It rejects moving refs and tag/commit mismatches, runs the checkpoint's
 full CI gate on `macos-15-intel`, and builds a certificate-free x64 artifact.
 
+The agent chooses the target explicitly. First record and verify that exact remote
+tag in the current worktree:
+
+```bash
+pnpm lastcode:intel-build select \
+  --tag lastcode/revision/v0.0.34-nightly.20260825.1185.3
+```
+
+Then run the imported **Build Intel package (macOS)** Project Action. The LastCode
+environment controlling this Action must run on macOS; the actual x64 build still
+runs on GitHub's hosted Intel runner. For agent-triggered
+one-shot continuation, enable **Allow Codex and Claude to run and resume** on that
+Action in Project Settings. The Action attaches a unique request token to the
+dispatch, waits for only the matching workflow run, and returns to the thread on
+success, workflow failure or cancellation, missing workflow configuration, or a
+run-registration timeout. It reports both the workflow-run URL and immutable
+release URL.
+
+The request is marked before dispatch so an interrupted or ambiguous transport
+result is never dispatched a second time. The Action waits for the unique token
+to appear and then records the matching run ID for later reattachment. If GitHub
+never registers it, select the tag again to create a deliberate new request.
+
+The Action only builds and publishes. It never stages, installs, promotes,
+restarts, or updates an Intel target. Those remain separate agent decisions.
+
 Successful output is attached to the installable tag as a GitHub prerelease,
 explicitly excluded from GitHub's latest-release selection. The release contains
 the complete build-manifest asset set, `build-manifest.json`, and `SHA256SUMS`.
@@ -151,8 +178,8 @@ deletes an exact-tag release. Recovery from a partial or conflicting publication
 therefore requires a maintainer decision rather than silently changing an
 immutable artifact.
 
-This workflow remains manual-only. Scheduling and installation are separate
-rollout gates.
+This workflow remains explicitly selected and action-dispatched. Scheduling and
+installation are separate rollout gates.
 
 ### Intel target staging
 

package.json

@@ -46,6 +46,7 @@
     "lastcode:checkpoints": "mise exec node@24.13.1 -- node scripts/lastcode-checkpoints.mjs",
     "lastcode:build": "mise exec node@24.13.1 -- node scripts/lastcode-build.mjs",
     "lastcode:install": "mise exec node@24.13.1 -- node scripts/lastcode-install.mjs",
+    "lastcode:intel-build": "mise exec node@24.13.1 -- node scripts/lastcode-build-intel-package.ts",
     "lastcode:intel-stage": "mise exec node@24.13.1 -- node scripts/lastcode-intel-stage.mjs",
     "lastcode:daily-update": "mise exec node@24.13.1 -- node scripts/lastcode-daily-update.mjs",
     "lastcode:headless-service": "mise exec node@24.13.1 -- node scripts/lastcode-headless-service.mjs",