fix: resolve draft releases in finalizer

[AlexMikhalev]

Summary

• resolve authenticated draft releases by exact tag through the paginated releases endpoint
• replace the published-only tag endpoint in every finalizer state check
• add regression coverage and validate against the real v1.21.14 draft

Evidence

• live resolver: draft release 389250394, exact staging SHA-256 69457dde3e588f192a12b989db76705bb5c48a49a636d5506305a566565a7e41
• 8/8 release contract tests pass
• actionlint, shellcheck, ruff, Bash syntax, and diff checks pass

This fixes a pre-dispatch API edge case; no signing or publication has occurred.