fix: make release publication draft-first and rate-limit recoverable #2534

Problem

The v1.10.3 publication path created and pushed the tag, then hit GitHub GraphQL rate limiting while creating the release. A REST fallback created an immutable release with zero BOM assets, and GitHub rejected later uploads. v1.10.4 had to be published through a manually staged draft release.

Required guardrail

Change the governed publisher so a release cannot become immutable until all required assets are present and verified.

• create a mutable draft release after the tag is verified
• upload the required BOM assets to the draft
• read back asset names, sizes, and checksums; validate the BOM against the exact release commit
• publish the draft only after verification succeeds
• add bounded retry/backoff and a documented REST fallback for GitHub API rate limits
• keep recovery idempotent when the tag already exists
• add tests covering rate-limit failure before assets, asset upload failure, checksum mismatch, and successful publication
• update the release playbook and operator output with the safe recovery procedure

Related: #2530 and #2532.