Merge main into dev: keep both the draft promotion and the consumer check

main and dev diverged: main was 2 commits ahead (the draft-then-promote
release workflow and the .busbar-ref pin to busbar 1.5.3
c8780349cf66d09b891478d50766b89dc1ff224c), dev 7.

Releases are cut from main, so nothing shipped was at risk. The hazard
was the next dev -> main pull request silently reverting main's fixes.

One conflict, .github/workflows/release.yml, and it was a false either-or:
the two sides appended DIFFERENT things at the same point in the file.
main added the promotion step that flips the Release out of draft once
assets are provably attached; dev added a new consumer-verification job
that pulls the published artifact back down and checks it works for a
stranger. Neither replaces the other, so both are kept, ordered by what
they are: main's lines are shell continuation of the verify-assets
run: block and now sit immediately after the asset-count check, and
dev's is a separate top-level job that follows. Confirmed the result
parses as YAML and that all six jobs are present, including the earlier
--draft on gh release create that makes main's promotion meaningful.

Gate run against a sibling checkout of busbar 1.5.3: cargo fmt --all
--check, cargo clippy --all-targets -D warnings and cargo check --tests
all pass.

Unrelated to this merge and left alone: the consumer-verification job
dev added passes bundle_image: 43 10, which is not an image reference.
That value is dev's pre-existing content, not something this merge
introduced, and it wants a look.

Author: MattJackson

.busbar-ref

@@ -1 +1 @@
-5681d648292cdc72b17b2d51c1575c9894b337c1 1.5.2
+c8780349cf66d09b891478d50766b89dc1ff224c 1.5.3

.github/workflows/release.yml

@@ -71,6 +71,7 @@ jobs:
           gh release create "${GITHUB_REF_NAME}" \
             --repo "${GITHUB_REPOSITORY}" \
             --title "busbar-hashicorp-vault ${GITHUB_REF_NAME}" \
+            --draft \
             --verify-tag --generate-notes \
           || gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}"
 
@@ -210,6 +211,12 @@ jobs:
                  "delete this tag+release, and re-cut." >&2
             exit 1
           fi
+          # Only now, with assets provably attached, does this stop being a draft and become
+          # the release that `releases/latest` resolves to.
+          gh release edit "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --draft=false --latest
+          echo "::notice::Published ${GITHUB_REF_NAME} with ${count} asset(s)."
 
   # THE LAST STEP: does what we just published work for a user?
   #