fix: stamp published_at on release publish (was NULL)

central/scripts/publish_agent_release.py

@@ -18,6 +18,7 @@ the exact same bytes again is a no-op (idempotent).
 import argparse
 import hashlib
 import sys
+from datetime import datetime, timezone
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
@@ -45,6 +46,7 @@ def publish(session, zip_path: Path, *, platform="windows", architecture="x64",
     dest.write_bytes(data)
     release = AgentRelease(version=version, platform=platform, architecture=architecture, filename=filename,
                             size_bytes=len(data), sha256=digest, storage_path=filename, status="PUBLISHED",
+                            published_at=datetime.now(timezone.utc),
                             release_notes=notes, created_by=created_by)
     session.add(release)
     session.commit()

central/tests/test_agent_distribution.py

@@ -122,6 +122,14 @@ def test_publish_is_idempotent_and_rejects_hash_conflict(hub, tmp_path):
             publish(session, write_temp_zip(make_release_zip("9.9.9") + b"\x00", "9.9.9"), version="9.9.9")
 
 
+def test_publish_records_published_at(hub, tmp_path):
+    _client, factory = hub
+    with factory() as session:
+        release, created = publish(session, write_temp_zip(make_release_zip("9.9.9"), "9.9.9"), version="9.9.9")
+        assert created and release.status == "PUBLISHED"
+        assert release.published_at is not None  # publishing stamps the moment, not left NULL
+
+
 def test_published_release_binary_never_stored_in_postgres(hub):
     _client, factory = hub
     release_id = publish_release(factory)