fix: immutable releases blocking artifact uploads

.github/rulesets/regression-protection.json

@@ -5,7 +5,7 @@
   "conditions": {
     "ref_name": {
       "exclude": [],
-      "include": ["~ALL"]
+      "include": ["~DEFAULT_BRANCH"]
     }
   },
   "rules": [
@@ -16,10 +16,10 @@
         "strict_required_status_checks_policy": false,
         "do_not_enforce_on_create": true,
         "required_status_checks": [
-          { "context": "CI / build (x86_64-linux)" },
-          { "context": "CI / build (aarch64-linux)" },
-          { "context": "CI / wasm" },
-          { "context": "CI / bench-regression" }
+          { "context": "build (x86_64-linux)" },
+          { "context": "build (aarch64-linux)" },
+          { "context": "wasm" },
+          { "context": "bench-regression" }
         ]
       }
     }

.github/workflows/release.yml

@@ -75,12 +75,24 @@ jobs:
           cd dist
           sha256sum *.tar.gz > checksums.txt
 
-      - uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            dist/*.tar.gz
-            dist/checksums.txt
-          generate_release_notes: true
+      - name: Create / update release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          TAG="${{ github.ref_name }}"
+          REPO="${{ github.repository }}"
+
+          if gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
+            gh release edit "$TAG" --repo "$REPO" --draft=true
+          else
+            gh release create "$TAG" --repo "$REPO" --draft --generate-notes
+          fi
+
+          gh release upload "$TAG" --repo "$REPO" dist/*.tar.gz dist/checksums.txt --clobber
+          gh release edit "$TAG" --repo "$REPO" --draft=false
 
   flakehub-publish:
     needs: release