fix(release): stage Beta packages until verification completes

.github/workflows/android-apk.yml

@@ -428,7 +428,9 @@ jobs:
         with:
           tag_name: ${{ github.ref_name }}
           name: OpenLess ${{ github.ref_name }}
-          draft: false
+          # The desktop and Android jobs share one Beta draft. Publish it only
+          # after all jobs and package verification have finished.
+          draft: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
           prerelease: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
           append_body: true
           body_path: ${{ runner.temp }}/android-release-body.md

.github/workflows/release-tauri.yml

@@ -501,7 +501,9 @@ jobs:
         with:
           tag_name: ${{ github.ref_name }}
           name: 'OpenLess ${{ github.ref_name }}'
-          draft: false
+          # Keep Beta assets private until all platforms have built and the
+          # administrator has verified the downloadable packages.
+          draft: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
           # beta 渠道的 release 必须标 prerelease=true：GitHub UI 会折叠它，
           # 普通用户看不到；同时只上传 latest-*-beta.json，正式版用户的
           # endpoint（latest-*.json）永远不会被覆盖，保证 Beta 不溢出正式版。