fix(release): publish the release only once it is signed

[sydorovdmytro]

Summary

• release.draft: true, and release.yaml publishes it as the last step of the release job, after signing and attestation. Immutability engages at publish, so publishing last is what keeps a release from being frozen without its provenance.
• It publishes by release id, not by tag. gh release edit <tag> resolves a tag by racing a published lookup against a draft one, so with more than one draft on the tag it can publish an older, unsigned draft and leave this run's behind.
• Preflight refuses to start when the tag already has a published release, or a draft goreleaser cannot cleanly replace. Otherwise the run pushes images and moves the floating tags first, then fails afterwards for nothing.
• replace_existing_draft added: goreleaser resolves an existing release by tag through an endpoint that returns published releases only, so without it a re-dispatch never sees the draft its own failed run left behind and adds a second one. replace_existing_artifacts stays for the in-run 422 retry on a landed-but-reported-failed upload. mode: replace dropped as unreachable.
• release.name_template pinned, since goreleaser's draft cleanup and the publish step both key on the release name.
• verify asserts .immutable == true. GET /repos/{owner}/{repo}/immutable-releases reports the repository setting directly but needs admin read, which no GITHUB_TOKEN permission grants, so a published release stays the only place an Actions run can see it.

Two trade-offs, both documented: verify runs after publish, so a verify failure needs a new tag rather than a re-dispatch; and goreleaser pushes the Homebrew cask while the release is still a draft, so its URL 404s until the publish step runs.

Test plan

• actionlint on release.yaml, shellcheck included: clean
• zizmor: no findings
• goreleaser check against the pinned v2.17.0 binary: passes
• shellcheck -x on the new run blocks, extracted verbatim: clean
• preflight jq exercised against nine draft states (none, one matching, untitled, retitled, two matching, name matching another tag, decoy beside a good draft, unrelated draft, live repo state): each classified as intended
• --paginate handling checked against a merged array, per-page arrays, [], and no output
• both gh api pipelines confirmed to fail closed under set -euo pipefail, so a failed listing cannot pass the guard
• go build ./... && go test ./...: pass
• The draft flow itself only proves out on a real tag; the next release is where immutable=true gets confirmed

Closes DEVOPS-1386