Fix race condition in announce endpoint causing missing platform artifacts

[mgoldsborough]

Summary

• Replace find-then-create pattern with Prisma atomic upsert in upsertVersion and upsertArtifact to eliminate P2002 race window
• When concurrent platform builds (linux-x64, linux-arm64, darwin-arm64) announce simultaneously, the second/third callers no longer hit a 409 that silently drops their artifacts
• Matches the existing upsertPackage approach which was already correct

Test plan

• pnpm typecheck passes
• pnpm lint passes
• pnpm test — 93/93 tests pass
• Deploy to staging, publish a multi-platform bundle, verify all 3 artifacts register

Closes #62

[JoeCardoso13]

APPROVE WITH COMMENTS

The find-then-create → upsert refactor is the right fix for the P2002 race. Clean change that aligns both methods with the existing upsertPackage pattern. A few things to consider:

1. Write-once backfill fields dropped from update path (non-blocking): The old upsertVersion update conditionally set releaseTag, releaseUrl, and readme when the existing record had nulls. The new update block omits them — so a version created before its GitHub release exists can no longer have these backfilled by a later announce. If intentional, a comment would help clarify; if not, they can be re-added with conditional spreads or a follow-up update using the pre-fetched existing.

2. created flag may be inaccurate under concurrent calls (non-blocking): Both methods derive created: !existing from a findUnique before the upsert. Two racers can both see existing === null and both return created: true. Fine if the flag is informational; worth checking if it triggers side effects.

3. Staging verification (non-blocking): The test plan's staging checkbox is unchecked. Unit tests confirm logic correctness, but the actual failure mode (concurrent platform builds) can only be validated end-to-end. Worth completing before merge.