fix(e9): publish beta drafts by release ID

[gnanirahulnutakki]

Root cause

v0.3.0-beta.1 safely failed at final publication because GitHub returns 404 for a draft through releases/tags/{tag}. Its signed artifacts remain in an unpublished draft; latest stable is unchanged.

Fix

• resolve the workflow-created draft via gh release view <tag> --json databaseId
• PATCH that ID with draft=false, prerelease=true, and raw string make_latest=false
• require this draft-aware lookup and forbid the draft-invisible tags endpoint in the policy test

Validation

• focused release policy/identity/release-PR tests
• make ci
• make release-check
• manual red-team review of draft lookup, stable path preservation, and immutable recovery

No tag rewrite, force push, draft deletion, or manual publication is included. After green dev -> main promotion, the corrected workflow will publish a new signed v0.3.0-beta.2.

Closes #159
Refs #154, #156, #157

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aa9cca36-18f2-49af-8a83-63068200086e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/fix/e9-beta-draft-publish

---

_{Comment @coderabbitai help to get the list of available commands.}