ci: draft-first release flow for immutable-releases compatibility

The repo has GitHub's immutable-releases lockdown enabled. The previous
flow had softprops/action-gh-release publish the release in one shot,
which raced the asset upload against the lockdown — uploads to a
just-published immutable release fail with "Cannot upload asset … to
an immutable release". The v0.2.0-pre.1 release ended up published
with no docker-compose-debugger.html asset attached.

Update all three release workflows (prerelease, release, stable-release)
to:
  1. Create the release with draft: true so the lockdown isn't applied.
  2. Upload the single-file HTML asset (allowed on drafts).
  3. Publish via `gh release edit "$TAG" --draft=false` in a follow-up
     step. The lockdown then applies to the already-attached asset.

This is the workaround the action's own error message recommends.

Author: bakerboy448

.github/workflows/prerelease.yml

@@ -65,9 +65,20 @@ jobs:
           git tag "$TAG"
           git push origin "$TAG"
 
+      # The repo has immutable releases enabled. softprops/action-gh-release
+      # creates and publishes in one step, which means the asset upload races
+      # against the immutable lockdown and fails. Create as draft, upload the
+      # asset, then publish in a follow-up step.
       - uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.prerelease.outputs.tag }}
           files: docker-compose-debugger.html
           generate_release_notes: true
           prerelease: true
+          draft: true
+
+      - name: Publish pre-release
+        env:
+          TAG: ${{ steps.prerelease.outputs.tag }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "$TAG" --repo "${{ github.repository }}" --draft=false

.github/workflows/release.yml

@@ -20,8 +20,17 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: cp dist/index.html docker-compose-debugger.html
+      # Immutable releases require draft-first so assets can be attached
+      # before the release is locked.
       - uses: softprops/action-gh-release@v2
         with:
           files: docker-compose-debugger.html
           generate_release_notes: true
           prerelease: ${{ contains(github.ref, '-') }}
+          draft: true
+
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: gh release edit "$TAG" --repo "${{ github.repository }}" --draft=false

.github/workflows/stable-release.yml

@@ -62,9 +62,18 @@ jobs:
           git tag "v${VERSION}"
           git push origin main --follow-tags
 
+      # Immutable releases require draft-first so assets can be attached
+      # before the release is locked.
       - uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ inputs.version }}
           files: docker-compose-debugger.html
           generate_release_notes: true
           prerelease: false
+          draft: true
+
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: v${{ inputs.version }}
+        run: gh release edit "$TAG" --repo "${{ github.repository }}" --draft=false