Rewrap the new cli_pypi guard comments in release.yml and
release-cli.yml to one sentence per line, per CLAUDE.md's
prose-wrapping rule (new prose must break only at sentence
boundaries, not at a fixed column width) — the same fix #6418
applied to a similar release-workflow comment.

Add the missing [Unreleased] CHANGELOG entry for this fix, matching
the established convention of every other CI-only fix PR in this
repo (#6410, #6389, #6416, #6418) recording a changelog line.

…op deleting CLI assets (#6433)

* fix(ci): publish CLI wheels to PyPI only for stable/LTS releases

The `librefang` PyPI project has a 10 GB total-size quota.
Each release uploads ~8 per-platform CLI binary wheels (~250 MB), and because every beta/rc tag published too, 46 accumulated pre-releases consumed 10.35 GB and pushed the project over quota — the v2026.7.10 stable `CLI / PyPI` job then failed with `400 Project size too large`.

Gate the `cli_pypi` job (in both release.yml and the manual release-cli.yml re-run path) to stable and LTS tags only.
A tag is treated as a pre-release when it carries any `-suffix` (e.g. `-beta.10`, `-rc.1`); `-lts` is the sole non-pre-release suffix, matching create_release's existing `-lts` special-casing.
Pre-release CLI binaries are still attached to the GitHub Release, and `librefang-sdk` (a separate PyPI project) is unaffected.

* docs(ci): rewrap cli_pypi gate comments and add CHANGELOG entry

Rewrap the new cli_pypi guard comments in release.yml and
release-cli.yml to one sentence per line, per CLAUDE.md's
prose-wrapping rule (new prose must break only at sentence
boundaries, not at a fixed column width) — the same fix #6418
applied to a similar release-workflow comment.

Add the missing [Unreleased] CHANGELOG entry for this fix, matching
the established convention of every other CI-only fix PR in this
repo (#6410, #6389, #6416, #6418) recording a changelog line.

* fix(ci): stop desktop re-release from deleting CLI binary assets

The desktop job's "Delete existing assets for this target" step matched `*<rust_target>*`, and the cli_* jobs name their uploads `librefang-<rust_target>.tar.gz|.zip` (+ `.sha256`) with the SAME target triple.
So when a desktop job re-ran after its CLI counterpart had already uploaded, it deleted the CLI binary tarball as collateral.
This is why the v2026.7.10 macOS CLI tarballs (`librefang-x86_64-apple-darwin.tar.gz`, `librefang-aarch64-apple-darwin.tar.gz`) disappeared after the desktop macOS jobs re-ran for notarization, which then made the `CLI / PyPI` job fail with a 404 when it tried to download them to build the wheels.

Skip CLI-owned assets (`librefang-*`, `SHA256SUMS*`) before the target-glob delete.
Desktop bundles use Tauri's own naming (`LibreFang_<ver>_<x64|aarch64|amd64|arm64>…`) which never contains the triple, so the guard costs the desktop nothing while protecting the CLI artifacts on every platform.

* docs(changelog): note the desktop asset-cleanup fix (#6433)

---------

Co-authored-by: Evan <[email protected]>
Co-authored-by: Claude <[email protected]>