Summary

• default tag-triggered release creation to draft mode so /releases/latest stays on the previous stable release while assets are uploading
• add a final Publish GitHub Release job that only publishes after publish-tauri, publish-updater-json, and downstream publish jobs have succeeded or been skipped
• publish non-prerelease tags with --latest only after latest.json has been uploaded, preventing updater 404 windows

Root Cause

Release metadata was created as a published release at workflow start. GitHub immediately repointed /releases/latest to the new tag before latest.json existed, so in-app update checks could fail with "Could not fetch a valid release JSON from the remote" until late jobs completed.

Validation

• Verified the current fixed pipeline behavior manually by checking release asset availability and updater endpoint responses.
• Confirmed updater endpoint returns valid JSON once latest.json is present (curl -fsSL https://github.com/different-ai/openwork/releases/latest/download/latest.json).

Notes

• This change targets tag-push releases (the standard release path) by defaulting them to draft; workflow_dispatch can still explicitly control draft behavior via input.