Create release as draft first, publish only after all artifacts are uploaded

gh release create without --draft publishes the release immediately via the
API before artifact uploads complete, leaving a window where users see an
empty release. Using --draft ensures all .tar.gz, .zip, and checksums files
are fully uploaded before gh release edit flips it to published.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: cx-aniket-shinde

.github/workflows/release.yml

@@ -152,12 +152,15 @@ jobs:
             gh release create "${{ inputs.tag }}" dist/*.tar.gz dist/*.zip dist/*checksums* \
               --title "Checkmarx One CLI ${{ inputs.tag }}" \
               --generate-notes \
-              --prerelease
+              --prerelease \
+              --draft
+            gh release edit "${{ inputs.tag }}" --draft=false
           else
             gh release create "${{ inputs.tag }}" dist/*.tar.gz dist/*.zip dist/*checksums* \
               --title "Checkmarx One CLI ${{ inputs.tag }}" \
               --generate-notes \
-              --latest
+              --draft
+            gh release edit "${{ inputs.tag }}" --draft=false --latest
           fi
 
   notify: