fix(ci): correct the upload-retry rationale and name-key its contract (#11364)

Real-runner probes on the PR showed the comment's two reasons for the
retry's overwrite do not reproduce: a stalled upload aborts before
finalize and reserves nothing, and name uniqueness is scoped per run
attempt so a manual re-run does not 409 either. Reword both comments to
the window overwrite actually covers — a first attempt that finalized
e2e-build and only then reported failure.

The contract test picked "the archive" by position (uploads[0]),
contradicting its own comment: an unrelated upload step placed before
the archive upload reddened the suite with misleading messages. Key on
the literal e2e-build name instead — already the pinned contract in
scripts/tests/e2e-workflow.test.js — in both the filter and the
download-leg assertion. Mutation probes: a decoy upload step before the
archive now stays green, while decoy+retry-deleted, retry-deleted,
retry-renamed, and overwrite-dropped all still fail.

.github/scripts/e2e-build.test.mjs

@@ -452,9 +452,7 @@ describe('e2e build artifact upload retry (e2e.yml build job)', () => {
     // Scope to the archive, not the action: an unrelated second artifact
     // in the build job must not redden the retry contract, and the two
     // attempts are bound by step name, never by position.
-    const archiveUploads = uploads.filter(
-      (s) => s.with?.name === uploads[0]?.with?.name,
-    );
+    const archiveUploads = uploads.filter((s) => s.with?.name === 'e2e-build');
     assert.equal(
       archiveUploads.length,
       2,
@@ -488,9 +486,10 @@ describe('e2e build artifact upload retry (e2e.yml build job)', () => {
     // (its conclusion is success; only its outcome is failure), so the retry
     // would never run while a substring pin still reads green.
     assert.equal(retry.if, "${{ steps.upload-build.outcome == 'failure' }}");
-    // The stalled first attempt reserves the artifact name for the run,
-    // and v4+ 409s a same-name upload — without overwrite the retry (and
-    // a manual re-run of the job) fails on Conflict, not on the network.
+    // v4+ 409s a same-name upload only against an artifact finalized in
+    // this run attempt — a stall aborts before finalize and reserves
+    // nothing, so overwrite guards the finalize-then-fail window: an
+    // attempt that finalized e2e-build and only then reported failure.
     assert.equal(retry.with.overwrite, true);
     // Both attempts publish the same payload under the same name; the
     // missing-archive guard rides on both so a pack regression fails
@@ -547,7 +546,7 @@ describe('e2e build artifact upload retry (e2e.yml build job)', () => {
       );
     }
     assert.ok(
-      consumed.has(uploads[0].with.name),
+      consumed.has('e2e-build'),
       'no leg downloads the artifact the build job publishes',
     );
   });

.github/workflows/e2e.yml

@@ -95,11 +95,12 @@ jobs:
       # deterministic failure (missing archive, via if-no-files-found:
       # error) fails both attempts and keeps the job red. The first
       # attempt's continue-on-error keeps that failure from failing the
-      # job before the retry runs; the retry's overwrite is load-bearing
-      # because the stalled attempt already reserved the e2e-build name
-      # and upload-artifact v4+ 409s on a same-name upload in one run —
-      # which is also what a manual re-run of this job after a stall
-      # would hit without it.
+      # job before the retry runs; the retry's overwrite covers the
+      # finalize-then-fail window: v4+ 409s a same-name upload only
+      # against an artifact already finalized in this run attempt, and
+      # a stall aborts before finalize and reserves nothing — but an
+      # attempt that finalized e2e-build and only then reported failure
+      # would 409 the retry without it.
       - name: 'Upload build artifact'
         id: 'upload-build'
         uses: 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' # v7.0.1