ci: release safety on main — draft-first promote + per-name asset verification - #9

.busbar-ref pins c8780349cf66d09b891478d50766b89dc1ff224c (what the release builds) but busbar@main is 6b37560db51e966920bc526354345c4f582e4989. Running BOTH; either leg red is red.