fix: reverify draft release assets

[tinkeragora]

Summary

• resolve draft releases through the authenticated releases list
• download draft assets by asset ID for pre-publication verification
• preserve fail-closed cleanup even when draft ID discovery fails
• add regression contracts that reject draft-incompatible tag lookup and download paths

Verification

• ruby scripts/test_release_workflow.rb
• workflow YAML parse
• all workflow Bash blocks pass bash -n
• git diff --check