Stage verified release drafts without replacing public assets

[Alex9001]

Summary

• Remove publication-triggered rebuilding and public asset replacement; publication becomes an explicit transition of a complete, verified draft
• Keep all six native builds, browser checks, Ubuntu runtime audits, upstream catalog validation, complete assembly, and provenance attestations
• Pin all candidate checkouts to the immutable workflow SHA and require tagged staging to use that exact tag, source version, and commit
• Stage only missing files on drafts, never clobber or delete assets, and verify the full 15-file remote name/state/size/SHA-256 manifest
• Document safe publication and exact-artifact retry behavior without adding token permissions, secrets, or dependencies

Validation

• Python packaging/release suite: 81 tests run, 80 passed, 1 skipped locally because zsync/zsyncmake are unavailable
• Includes 32 new draft-staging/workflow regression tests: all passed
• Node packaging-tool tests: 12 passed
• Release version validation, shell syntax, Python compilation, and git diff whitespace checks passed
• Full hosted CI and a fresh merged-commit six-platform release rehearsal remain required before tagging or publication

Operational boundary

Wait for staging to finish before publishing. GitHub does not offer an atomic upload-only-if-still-draft operation, so the helper checks draft state before each upload and afterward, and serializes workflow writers. Existing conflicting or incomplete assets cause a safe stop and require review; no automatic cleanup occurs.

No release was created or published. This PR is intentionally draft for review.