test(publish): assert the real GitHub client creates a draft Release #14

Goal

Make CI fail if the real GitHub client ever creates a non-draft Release when draft is passed.

Why

The review of #13 tried this mutation. In lib/publish.mjs github(), the create-release POST body changed from draft: !!draft to draft: false. node --test stayed green (publish.test.mjs: 11 pass, 0 fail). The tests inject a fake clients.github, so they never check the request that actually creates the Release. The other guards caught their mutations: the workflow text guard in lib/unattended.test.mjs, and the isUnattended() refusal in publish().

Suggested approach

Add a test that stubs global fetch, calls the real github() (export it or reach it through publish with default clients) with draft: true, and asserts:

• the POST /releases body has draft: true;
• when a draft run finds a published Release, it sends no PATCH that changes draft.

Validation

Flip draft: !!draft to draft: false and run node --test lib/publish.test.mjs. It must fail.

Follow-up from duyet/anyrouter#6656.