fix(release): keep SDK qualification releases in draft

[777genius]

SDK qualification currently publishes every newly built release. Add a publish_release boolean defaulting to false so qualification retains a draft until explicit approval of that version.

Draft runs verify downloaded bytes and retain separate mutable qualification evidence. Public release verification remains strict and separate. Explicit publication preserves the existing single-edit and reconciliation behavior. Draft identity checks compare stable IDs, names, sizes and digests, excluding download counters and asset ordering.

Validation: 133 release workflow tests passed, including no-publication defaults, invalid input rejection, increasing counters, reordered assets and identity/content drift rejection. Independent review found the counter issue, now reproduced and fixed. Ruff and diff checks passed. No live release was created or published.

Stacked on #66; the diff is limited to release workflow, helper, tests and documentation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3c1b2b55-bf94-4a42-8ec2-1c17a629c9bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}