Repair release publication transport and draft cleanup

[kb2vhn]

Purpose

Repair the release-publication defects discovered during the first formal
publication attempt for the signed isras-v0.1.3 tag, and advance the next
candidate release identity to 0.1.4.

The signed isras-v0.1.3 tag remains immutable. It was not published and is not
accepted release or consuming-project adoption authority. Its exact empty failed
draft, release ID 356329939, was independently verified and deleted before this
candidate was prepared.

Confirmed defects

1. Asset upload used gh api --hostname uploads.github.com, which caused GitHub
   CLI to derive the invalid destination api.uploads.github.com.
2. Release absence used a tag-only lookup that did not expose draft releases.
3. Failed-draft cleanup reused that lookup and could report success while the
   exact empty draft still existed.

Repair

This candidate:

• advances VERSION and validator identity to 0.1.4;
• discovers releases through a complete paginated inventory that includes drafts;
• rejects any existing draft or published release for the selected tag;
• uploads exact assets through gh release upload without --clobber;
• re-reads and verifies the exact draft by release ID after every upload;
• inspects, deletes, and verifies failed-draft absence by exact release ID;
• rejects partial, duplicate, altered, or unexpected draft asset state;
• preserves the immutable isras-v0.1.3 tag and documents it as unpublished and
  non-adoptable;
• synchronizes the changelog, README, adoption guide, publication standard, and
  release notes.

Exact candidate boundary

• Base commit: b78dd0feaf8b8891963a0fc6bc4338ee33991c4b
• Candidate commit: 74baf28b0503da21a0e2654b414d4957304c21f1
• Head branch: fix/release-publication-transport-and-draft-cleanup
• Base branch: dev
• Changed files: exactly 10
• Candidate commit signature: verified
• Version: 0.1.4

Validation completed

• detached-worktree repair preflight;
• exact ten-file inventory;
• focused publication package tests;
• focused race tests;
• focused go vet;
• repository-owned publication command build and tests;
• complete go test ./...;
• complete go test -race ./...;
• complete go vet ./...;
• complete development validation;
• clean commit-mode validation;
• known-vulnerability validation with no reachable findings;
• secret protection with no unresolved findings.

Boundaries

This pull request does not:

• create or push isras-v0.1.4;
• modify isras-v0.1.3;
• build or publish release assets;
• create or publish a GitHub Release;
• move main;
• modify a consuming project;
• claim 0.1.4 publication or adoption readiness.

After merge, the exact merged dev boundary must pass post-merge validation,
clean-clone release validation, signed-tag preparation, deterministic artifact
production, publication preflight, controlled publication, remote-byte
verification, and neutral hosted consuming-project validation.