release: draft the Release until assets are verified, so latest never points at nothing

[MattJackson]

Problem

create-release publishes this repos GitHub Release before the build matrix runs. If every target then fails to build, pack, or upload, the tag is left with a published Release carrying zero assets and releases/latest resolves to nothing. Anything following releases/latest, including busbars plugin-registry gate, sees an empty release.

This is not hypothetical: GetBusbar/webrequest-hook shipped exactly that phantom on the busbar 1.5.3 cascade (v1.0.4, zero assets, deleted by hand). This repo has the identical workflow shape, so it has the identical bug, and any total build failure will trigger it.

The existing verify-assets guard already detects the assetless case, but only after the empty Release is public. Detection is not prevention.

Fix

Create the Release as a draft, and let verify-assets promote it to published only once assets are provably attached. A release is then either complete or absent.

Verified end to end against a throwaway repo before applying:

• gh release create --draft --verify-tag works.
• GET /repos/{o}/{r}/releases/tags/<tag> returns 404 while draft, and releases/latest does not resolve it. This is the property that makes the empty window invisible.
• gh release upload <tag> and gh release view <tag> still resolve the draft by tag with the workflow token, so the matrix upload jobs and the asset count are unaffected.
• gh release edit <tag> --draft=false --latest promotes it and points latest at it.

The build matrix, packing, signing, attestation, and the downstream notify are all untouched. verify-assets keeps its existing hard-fail on zero assets; the only change is that the failure now leaves an unpublished draft rather than a public phantom, so there is nothing to clean up by hand.

Fleet-wide change, applied identically to every first-party plugin repo sharing this release shape (store, auth, hook, and secret plugins).