ci: prepare draft releases from signed tags

[proddata]

Requirement

Add a Barnacle-style tag-triggered release pipeline while preserving the repository's release-readiness policy. A signed v* tag now starts the normal validation, CodeQL, PostgreSQL 18/19 candidate packaging, and Keycloak interoperability gates. It assembles a draft GitHub Release only after all jobs pass.

Trust boundary and failure behavior

• The tag job requires SemVer syntax, an annotated tag, an exact checked-out commit on main, and a signature GitHub reports as verified. Missing or unverifiable signatures stop the workflow.
• The draft job rechecks that the remote tag object has not moved. It validates both downloaded package digests, versions, source revisions, PostgreSQL majors, embedded manifests, evidence files, and the complete asset set before creating SHA256SUMS.
• Only the final draft job receives contents: write; validation and package jobs remain read-only. No workflow job publishes the draft.

User-visible and compatibility effects

• A signed release tag creates a draft GitHub Release containing PG18 and PG19 preview artifacts. The manual release-candidate workflow remains available.
• Publication still requires an approved release key, signed assets, independent review, and the remaining rehearsals in docs/release-readiness.md. PostgreSQL 19 is still preview-only.
• To roll back this automation, disable or revert the Release draft workflow; retain the candidate artifacts and tag for investigation. Do not move a published tag.

Verification

• sh tests/ci/test_release_artifacts.sh
• sh tests/ci/test_prepare_release_draft.sh (accepted pair; rejects altered manifest, extra file, changed archive, altered checksum filename, missing evidence)
• sh -n scripts/ci/prepare-release-draft.sh tests/ci/test_prepare_release_draft.sh
• actionlint -color=false .github/workflows/*.yml with pinned actionlint v1.7.12
• ./scripts/ci/check-source-tree.sh and git diff --check

No live release tag was pushed for this PR, so the tag event and draft creation remain to be exercised with the first approved candidate. The PR checks cover the reusable validation and package scripts; they do not publish anything.