ci: promote immutable C++ packages

[uartnet]

Summary

• build signed package and Conan candidates without publishing them
• require the protected stable-release environment before any external upload
• restore and publish exact Conan revisions and package archives without rebuilding
• keep GitHub releases as drafts until every package target is published

Validation

• actionlint and ShellCheck
• release workflow regression tests
• candidate archive checksum tests with a real published package artifact
• Conan 2.26.2 create, cache save, clean-cache restore, and integrity verification
• Gitleaks and workspace Git identity guard