Contract artifacts are not published for released commits

`packages/contracts-bedrock/scripts/ops/publish-artifacts.sh` uploads a contract artifacts tarball keyed by the checksum from `calculate-checksum.sh`. It appears to be run manually rather than by CI, so released commits do not reliably have artifacts published.

### What we hit

Upgrading `ethereum-optimism/supersim` to `op-node/v1.16.13` (`6de21d0f`), its `just calculate-artifact-url` resolved to a tarball that returns HTTP 404 from `oplabs-contract-artifacts`. The previously pinned commit's tarball returns 200. Two independently computed checksums for the new commit both 404.

supersim consumes this bundle to generate its genesis. The workaround was building `contracts-bedrock` locally (421 artifacts) and pointing `--monorepo-artifacts` at the local path, which is fine for a laptop but not for CI.

### Caveat

The bucket is not anonymously listable, so we cannot fully rule out a local checksum mismatch rather than a missing upload. Someone with bucket access could confirm quickly by listing objects for that checksum.

### Ask

Either publish artifacts automatically for tagged releases, or document that consumers should build locally and treat `calculate-artifact-url` as best effort.

Start with packages/contracts-bedrock/scripts/ops/publish-artifacts.sh and calculate-checksum.sh, then trace how just calculate-artifact-url resolves the artifact tarball. Check how tagged releases or CI currently invoke artifact publication and verify the checksum object for a released commit. Done means released commits reliably have downloadable tarballs, or the consumer-facing behavior is documented as best effort with local-build guidance.

Written by the indexing model from the issue text.