Pull request overview

This PR implements immutable releases by ensuring that releases are created as drafts first, then published only after all assets (binaries, signatures, provenance, and release notes) have been uploaded successfully. This prevents partial releases from being visible to end users.

Changes:

• All release operations now interact with draft releases until final publication
• New publish-release job publishes the draft release as the final step
• Signature verification now runs after publication to ensure release integrity

      - name: Fail if Release already exists for this tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ steps.reltag.outputs.tag }}"
          if gh release view "$TAG" --repo "${{ github.repository }}" >/dev/null 2>&1; then
            echo "Release $TAG already exists. Aborting to avoid overwrite." >&2
            exit 1
          fi

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.