[FermiHart]

Summary

• add an explicit workflow_dispatch recovery path for an existing signed release tag
• poll GitHub release listings after draft creation to tolerate API propagation delay
• bind draft ownership to the immutable tag object commit while permitting a later workflow run to resume the same owned draft
• continue checking push event SHA equality while allowing manual recovery to validate the tag independently

Root cause

gh release create --draft succeeded for SDK 1.4.0, but the immediately following paginated release listing did not yet expose the new draft. The workflow failed closed before uploading assets.

Testing

• make check
• python3 -m unittest tests.test_release_policy -v
• git diff --check

Recovery

After merge, dispatch the updated release workflow from main with release_tag=sdk-v1.4.0. It will checkout and revalidate the immutable signed tag, rebuild and sign assets, then resume draft ID 376340815 only if tag, commit, body ownership, and draft state still match.