fix: harden release publishing

[intel352]

Summary

• keep post-build capability and contract verification in the GoReleaser job where dist/artifacts.json exists
• install wfctl through setup-wfctl instead of a manual curl
• publish draft releases with gh release edit after verification succeeds

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release.yml ok"'\n- GOWORK=off go test ./...\n- GOWORK=off go vet ./...\n- GOWORK=off go build ./...\n- goreleaser check\n\n## Context\nThe latest Teams release tag has no published release, and the current workflow split publish verification into a job without checkout, wfctl, or dist/artifacts.json. This makes the next patch release publishable.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions release workflow by ensuring post-build verification (capabilities + contract validation) happens in the same job that produces dist/artifacts.json, switching wfctl installation to setup-wfctl, and publishing the draft release only after verification succeeds.

Changes:

• Move release execution to ubuntu-latest and keep verification steps colocated with GoReleaser outputs.
• Install wfctl via GoCodeAlone/setup-wfctl@v1 and use it for pre/post build contract validation and capability verification.
• Publish the GitHub release draft via gh release edit ... --draft=false after verifications succeed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.