Fix v0.2.5 draft release recovery

[JamesLinYJ]

Summary

• resume publication when the package tag already exists but its GitHub Release is missing or still a draft
• include release workflow changes in the main-push trigger so a release-recovery fix can retry the current version without moving its tag
• locate draft releases through the authenticated list-releases endpoint, verify every asset digest and size, publish by numeric release ID, then confirm the public tag endpoint
• pass manual release tags through the environment and validate semantic-version syntax before using them

Root cause

Release run 31324173275 successfully built all three Windows targets, wrote checksums, created provenance attestations, and created the v0.2.5 draft. The next step called GET /repos/{owner}/{repo}/releases/tags/{tag}, which only returns published releases, so reading the draft deterministically returned HTTP 404.

The tag remains fixed at 33e2c3f0ab6f26d763faa1386e8e9506519a26a9. After this fix merges, the workflow will detect and resume the existing draft instead of creating or moving the tag.

Validation

• actionlint 1.7.12 .github/workflows/release.yml
• YAML parse and expected four-job graph
• git diff --check
• independent review of REST draft visibility, PowerShell pagination, typed PATCH fields, and retry behavior
• the post-merge Release run remains the authoritative end-to-end validation