Release runs publish a public non-draft release before all assets exist — draft-then-promote #275

From PR #272's review (which gated publish-npm on the build matrix, #221): the gate protects the npm path only. The GitHub release itself is created public/non-draft while build legs are still uploading — a partial failure leaves a public 'latest' with missing assets, which install.sh / install.ps1 users resolving latest will hit as download errors. Suggested shape: create the release as a DRAFT, have the build matrix upload assets to the draft, and add a final promote job (needs: build) that flips it public — so 'latest' only ever points at a complete release. Interacts with tauri-action's release creation — check what it supports natively. Origin: rev-24 on PR #272.