P0 E9: publish beta draft release by database ID

[gnanirahulnutakki]

Parent: #27. Follow-up to #154 and failed beta tag workflow 29367518390.

Incident

Signed tag v0.3.0-beta.1 passed GitHub tag verification, and the release job built archives, SBOMs, Sigstore bundles, and attestations into a draft. The final beta publication step failed safely because GET /releases/tags/{tag} returned 404 for the draft release, leaving it unpublished. Latest stable v0.2.1 was not changed.

Scope

• Resolve the draft release through gh release view <tag> --json databaseId, which can read the workflow-created draft, then patch that ID with draft=false, prerelease=true, and API string make_latest=false.
• Tighten the policy test to require the draft-safe lookup.
• Preserve all tag classification, signed/annotated/main ancestry gates, stable release behavior, and immutable recovery.
• Publish a new signed immutable v0.3.0-beta.2 only after the correction is proven through dev -> main; do not rewrite, delete, or force-push v0.3.0-beta.1.

Acceptance

• A beta draft can reach the final publication call without tag-lookup 404.
• The released beta is a GitHub prerelease and does not replace the latest stable release.
• Failed beta.1 remains unpublished and untouched.

Refs: #154, #156, #157.

[gnanirahulnutakki]

Completed through #160 and release PR #161.

v0.3.0-beta.1 is intentionally preserved as the immutable failed draft: it built, signed, and attested assets but safely failed at draft tag lookup; no deletion, rewrite, force push, or manual publication occurred.

The repair resolves the workflow-created draft with gh release view <tag> --json databaseId, retains draft=false, prerelease=true, and raw-string make_latest=false, and is covered by the release policy test.

Published v0.3.0-beta.2 release evidence:

• PR fix(e9): publish beta drafts by release ID #160 CI 29367830307 and CodeQL 29367828109 passed
• exact post-merge dev CI 29368327885 and CodeQL 29368327085 passed
• release PR release: v0.3.0-beta.2 #161 CI 29368893941 and CodeQL 29368890834 passed
• exact main CI 29369389761 and CodeQL 29369388611 passed
• tag workflow 29369927887 passed; GitHub tag verification passed
• beta.2 is immutable, published, and prerelease; stable latest remains v0.2.1
• macOS-arm64 archive passed checksum, Sigstore, GitHub provenance, version, and loopback UI smoke
• security queues: Dependabot 0, code scanning 0, secret scanning 0