fix(hub): revert worker streaming + disable whole-package zip; cut email 0.2.4

[itomek]

Gets the email-agent release unblocked. The ~177 MB all-platforms whole-package zip (#1843) exceeds Cloudflare's edge upload limit — POST /publish returns 413 Payload Too Large before the request even reaches the worker, which blocked the release on 0.2.1–0.2.3 (each published its binaries but never the zip/npm). That edge limit is plan-based and not fixable in worker code, so the worker-side streaming attempt (#1849) couldn't have solved it.

This reverts that streaming change and disables the whole-package zip publish (if: false, with a note to revive it via presigned-to-R2 or per-platform zips). 0.2.4 ships the per-platform binaries + npm client + website with no combined zip — the binaries stay individually downloadable from the Hub. No agent wire-contract change (SCHEMA_VERSION stays 2.0).

What's in here

• Revert fix(hub): stream large artifacts to R2 so the whole-package zip publishes; cut email 0.2.2 #1849 — restores the worker + publish_to_r2.py to the multipart-only path; worker suite back to 64 tests passing.
• Disable the zip steps — "Assemble + publish the whole-package zip" and its edge-verify step are if: false; the binary fetch-verify, npm publish, and website redeploy are untouched.
• 0.2.4 bump — all six version targets synced via stamp_version.py + CHANGELOG.

Test plan

• stamp_version.py --check passes (all targets 0.2.4)
• worker npm run typecheck && npm test — 64 pass (revert clean)
• cd hub/agents/npm/agent-email && npm run build && npm test — 46 pass
• Tag agent-pkg-email-v0.2.4 → release publishes binaries + npm @0.2.4 + website (no zip step)

[itomek-amd]

Unblocks the release: reverts the worker streaming attempt and disables the over-limit whole-package zip; 0.2.4 ships binaries + npm without it. Version targets in sync. Approving to land on main.

[github-actions]

Verdict: Approve ✅

This unblocks the email-agent release by reverting the worker-side streaming publish attempt and disabling the ~177 MB whole-package zip step (which Cloudflare's edge upload limit rejects with a 413 before the worker even runs), then cuts 0.2.4 shipping the per-platform binaries + npm client without the combined zip. The revert is clean: the worker's multipart path and the per-platform binary publish are untouched, and the version bump is consistent everywhere.

The bottom line: this is the right call — the 413 is a plan-based edge limit that worker code can't fix, so reverting #1849 and parking the zip behind if: false (with a revive note) is the correct unblock. Nothing here needs changes before merge.

🔍 Technical details

Verification performed

• 🟢 No dangling references after the worker revert — finishPublish, handleStreamingPublish, decodeBase64Utf8, SHA256_RE, validatePackageFilesJson, and the removed ParsedManifest/AgentManifest type imports have zero remaining uses in workers/agent-hub/src/publish.ts; optionalPackageFiles is defined and still called from the multipart path (publish.ts:172).
• 🟢 Python revert clean — publish_to_r2.py has no leftover publish_streaming / _b64 / _CHUNK / base64 references; package_files_bytes correctly remains on the retained multipart publish_one path.
• 🟢 Version consistency — all six targets land on 0.2.4 (pyproject.toml, version.py, gaia-agent.yaml, package.json, binaries.lock.json, architecture.html); no stray 0.2.3 outside the historical CHANGELOG entry. SCHEMA_VERSION correctly stays 2.0 (no wire-contract change).
• 🟢 Test deletions are correct, not coverage loss — tests/unit/test_publish_to_r2_stream.py and the worker streamPublish* tests exercised the removed streaming code, so deleting them alongside it is right (no orphaned tests referencing deleted symbols).

Notes (non-blocking)

• The disabled workflow steps stay in release_agent_email.yml as dead YAML behind if: false. That's intentional per the revive note (presigned-to-R2 or per-platform zips) and the matching if: false on the edge-verify step keeps the two in lockstep — fine to leave as-is.

Strengths

• Surgical revert: the contract-bearing multipart path and the binary fetch-verify / npm-publish / website-redeploy steps are left completely untouched, so the blast radius is just the zip path.
• CHANGELOG + PR body clearly explain why (the 413 is an unfixable edge limit, not a worker bug) and what 0.2.4 actually ships — exactly the user-observable framing the project asks for.