ci(release): gate build jobs behind release creation

[Lythaeon]

Summary

• check GitHub release state (published vs draft) when resolving release tags
• add a prepare-release job that ensures a draft release exists before binaries/publish jobs run
• make build/publish depend on prepare-release and finalize by updating the draft release with artifacts

Risk Notes

• release resolution now calls GitHub Releases API and relies on GITHUB_TOKEN API access
• if release preparation fails, binary builds are intentionally blocked

Validation

• reviewed job dependency graph and conditions in .github/workflows/release.yml
• verified diff only touches release workflow behavior