fix: use draft releases to prevent immutability errors

GitHub's immutable releases feature locks releases upon publication,
preventing asset uploads. This fix uses a two-step process:
1. Create draft release (mutable) and upload tarball
2. Publish release after assets are attached

Also adds validation to ensure tarball name matches package.json,
preventing future naming mismatch issues.

Changes:
- Upgrade from softprops/action-gh-release@v1 to @v2
- Create release as draft initially (draft: true)
- Add separate publish step after asset upload
- Add tarball name validation step

Fixes release workflow failures that occurred with v0.3.6 and v0.3.7.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

.github/workflows/release.yaml

@@ -55,6 +55,23 @@ jobs:
         if: env.SKIP_BUILD != 'true'
         run: npx @kinvolk/headlamp-plugin package
 
+      - name: Validate tarball name matches package.json
+        if: env.SKIP_BUILD != 'true'
+        run: |
+          PACKAGE_NAME=$(jq -r '.name' package.json)
+          VERSION=${GITHUB_REF_NAME#v}
+          EXPECTED_TARBALL="${PACKAGE_NAME}-${VERSION}.tar.gz"
+          ACTUAL_TARBALL=$(ls *.tar.gz)
+
+          if [ "$EXPECTED_TARBALL" != "$ACTUAL_TARBALL" ]; then
+            echo "::error::Tarball name mismatch!"
+            echo "Expected: $EXPECTED_TARBALL"
+            echo "Actual:   $ACTUAL_TARBALL"
+            echo "Update workflow to use correct tarball name pattern"
+            exit 1
+          fi
+          echo "✓ Tarball name validation passed: $ACTUAL_TARBALL"
+
       - name: Compute tarball checksum
         if: env.SKIP_BUILD != 'true'
         run: |
@@ -65,17 +82,25 @@ jobs:
           echo "Tarball: $TARBALL"
           echo "Checksum: sha256:$CHECKSUM"
 
-      - name: Create GitHub release and upload tarball
+      - name: Create draft release and upload tarball
         if: env.SKIP_BUILD != 'true'
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: ${{ env.TARBALL }}
           fail_on_unmatched_files: true
-          draft: false
+          draft: true
           prerelease: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Publish release
+        if: env.SKIP_BUILD != 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          draft: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Update metadata and align tag
         if: env.SKIP_BUILD != 'true'
         run: |