ci: upload immutable release assets before publish

[bryanwieg]

Summary

• pass source-release assets directly to the native GitHub release-create command so GitHub stages them on a draft before publication
• recover safely from complete or partial drafts left by interrupted uploads
• require the final source release to be published, server-immutable, and byte-identical to the staged assets
• avoid blind retries of multi-request release mutations after ambiguous timeouts

Incident

Production run 35900764817 successfully built, signed, published, and publicly verified the 26.7 package channel. Its final source-release job failed with HTTP 422 because it published an immutable release before separately uploading the package and build metadata.

The package channel and public installation verification were unaffected.

Verification

• focused release/workflow suite: 78 passed, 3 subtests passed
• full CI helper suite: 310 passed, 3 subtests passed
• Python compilation and git diff check passed
• independent specification, release-security, code-simplification, test-suite, and documentation-impact reviews: no blocking findings