fix(release): upload with gh, not an action that insists on managing the draft

[MotherSphere]

With the job skips fixed, all four builds finally ran, compiled, and passed
their smoke test - and then every one failed uploading:

Found release v0.10.0 (with id=377998799)
Unexpected error fetching GitHub release for tag refs/heads/main:
HttpError: Resource not accessible by integration
- .../rest/releases/releases#update-a-release

softprops/action-gh-release does not just upload assets: it PATCHes the release
to manage the draft flag, and that update is refused against this draft. The
workflow grants contents: write and the repository default is write, so this is
the action's own insistence on owning a field it does not need to touch.

That insistence is also what published an empty v0.10.0 in front of users
earlier today: absent a draft: input it calls finalizeRelease() after
uploading, which sets draft:false. Adding draft: true stopped that, and now
the same code path 403s.

gh release upload only ever adds assets. It cannot publish a release, so the
draft is safe by construction rather than by remembering a flag - and it is
exactly what the sign job has done successfully since v0.9.2, in this same
workflow, with this same token. The action leaves the release path entirely,
which also removes a third-party action holding write access to releases.

The draft assertion after the upload stays. It is now belt-and-braces rather
than load-bearing, and it costs one API call.