chore: parallel builds with Makefile (#3854)

* Revert "revert: Makefile buff-ification (#3700) (#3848)"

This reverts commit e490bdd531.

* fix: fix slim targets in makefile

* fix: don't clobber slim binaries, make sure they're in the correct location

scripts/publish_release.sh

@@ -3,6 +3,10 @@
 # This script generates release notes and publishes all of the given assets to
 # GitHub releases. Depends on GitHub CLI.
 #
+# THIS IS NOT INTENDED TO BE CALLED BY DEVELOPERS! This is called by the release
+# pipeline to do the final publish step. If you want to create a release use:
+#   git tag -a -m "$ver" "$ver" && git push origin "$ver"
+#
 # Usage: ./publish_release.sh [--version 1.2.3] [--dry-run] path/to/asset1 path/to/asset2 ...
 #
 # The supplied images must already be pushed to the registry or this will fail.
@@ -25,6 +29,10 @@ set -euo pipefail
 # shellcheck source=scripts/lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
+if [[ "${CI:-}" == "" ]]; then
+	error "This script must be run in CI"
+fi
+
 version=""
 dry_run=0