chore(release): publish versioned c7n docs tarball to S3

[jtroup]

ENG-7788

what

Two additions to the Publish job in stacklet-release.yml:

• A generic Assert prerelease version step, first after checkout:
  it reads the version from pyproject.toml and fails the release
  before anything is built or published if the version isn't a
  prerelease (…aN).
• After the existing wheel publish, build the Sphinx docs
  (make sphinx) and upload the HTML tree as a version-keyed
  tarball (<version>.tar.gz) to the stacklet-c7n-prerelease-docs
  S3 bucket.

Separately, in tools/c7n_awscc/c7n_awscc/manager.py,
initialize_resource now only registers the delete action when the
resource's CloudFormation schema actually declares a delete handler,
mirroring the existing guard on the update action.

why

The Stacklet platform docs site surfaces the Cloud Custodian reference
docs by fetching a prebuilt tarball keyed on the c7n version it
pins. Publishing that tarball from the same release that ships the
wheels keeps the docs locked to the released version, with no separate
pipeline to drift out of step. This repo should only ever ship
prereleases, so asserting that once, up front, guards the whole release
— wheels and docs — against a misconfigured version.

The AWSCC data/*.json schema files are gitignored and fetched fresh
at build time, and the current schemas include resources with no
delete handler. The code unconditionally read
rinfo["handlers"]["delete"]["permissions"], raising KeyError: 'delete' during load_resources(), which broke import — and therefore
test collection — for every suite that loads resources; in CI it
surfaced as ~24 collection errors across the c7n_kube tests.

testing

Relying on CI.

docs

N/A

---

🤖 Generated with Claude Code