fix(release): publish GitHub release only after assets and checksums are verified #263

Objective

Publish GitHub releases only after every asset, package and checksum is in place, so distribution channels never consume partial releases.

Plan

• Stage the release as a draft; upload binaries and packages to it.
• Generate sha256sums.txt only after every expected asset exists.
• publish-release re-downloads the draft, verifies checksums and file set, then sets draft=false.
• Channel jobs (npm, Homebrew, AUR, WinGet, Scoop, Nix, APT, RPM, APK) depend on publish-release.
• Retire x86_64-netbsd and aarch64-netbsd until the Zig 0.17.0 link failure is fixed.

Status

Done: implemented and merged in #262 (merge commit 68a9fd9).

Blockers

None. NetBSD returns when the Zig 0.17 link failure (__ssp_protected_* in sqlite3.c) is fixed.

Acceptance

• Channel jobs never run before the public release is verified.
• Failed build or checksum stops the release from being published.
• A release with NetBSD can be re-enabled once a test release links on NetBSD.