fix(ci): promote latest Release Drafter draft on tag and add tag highlights

[kwent]

Summary

The release job in publish.yml failed for v0.4.0 (npm publish itself succeeded):

• It only promoted a draft whose tag_name == GITHUB_REF_NAME, but Release Drafter had resolved the draft to v0.3.1 (no breaking/enhancement labels on the merged PRs), so nothing matched.
• The fallback gh release create then crashed with fatal: not a git repository because the job never checked out the repo.

This ports the release logic already used by rootly-swift (worked for v2.0.0):

• check out the repo and fetch the annotated tag
• promote the most recent draft regardless of its tag, renaming tag_name/name to the pushed tag
• prepend the annotated tag message under ## Highlights
• fall back to gh release create --verify-tag --generate-notes (with highlights if present) when no draft exists

Note: this does not retroactively fix v0.4.0; tag-triggered runs use the workflow at the tagged commit, so that release must be published manually from the draft.

Risk: low — release-only CI job, no SDK code changes; actionlint clean.

Link to Devin session: https://rootly.devinenterprise.com/sessions/af696ad13f4e47a09908c76ef0b67191
Open in Devin Desktop: https://rootly.devinenterprise.com/desktop/session/af696ad13f4e47a09908c76ef0b67191?variant=devin
Requested by: @kwent

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring