ci: rework release workflow for immutable releases

Switch the release workflow to create a draft release, and upload the
build artifacts to the draft, using the gh CLI instead of
softprops/action-gh-release. This prepares for enabling immutable
releases, which require all assets to be uploaded prior to publishing.

The release process now requires a maintainer to manually publish the
draft release once all CI artifacts have been uploaded and any
remaining assets (e.g. the source tarball, checksums and signatures
files) have been attached.

While modifying release.yml:
 - Tighten workflow permissions: default to no permissions and grant
   contents: write to both jobs.
 - Set persist-credentials: false on actions/checkout so the
   GITHUB_TOKEN is not left in .git/config during runs.
 - Set cancel-in-progress: false to prevent a second tag push from
   canceling an already-running workflow and leaving a dangling release.
 - Move all ${{ ... }} expressions in run blocks into env to avoid shell
   interpolation of workflow context values.
 - Add name key to every step in build-windows.

0 files changed, 0 insertions, 0 deletions