fix(release): 修正 updater 清单的下载 URL 与发布顺序

发布时 verify update manifest 失败：draft release 的资产 URL 为
`.../releases/download/untagged-<hash>/...`，而校验要求 URL 含 tag 名。

- create-update-manifest.mjs 不再依赖 draft release 的
  browser_download_url，改为按 tag 与资产名自行拼接稳定的
  `.../releases/download/<tag>/<name>` 地址。
- build-on-tag.yml 将 Publish release 提前到生成/校验清单之前，
  使清单在 release 已发布后生成；并移除多余的
  “Refresh published GitHub release metadata” 步骤。
- catalog.ts 版本公告更新为 1.0.0-beta13。

.github/workflows/build-on-tag.yml

@@ -303,6 +303,20 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release download "${GITHUB_REF_NAME}" --pattern '*.sig' --dir release-check/signatures
 
+      # Publish the draft release before generating the updater manifest. While
+      # the release is a draft GitHub reports asset URLs as
+      # `.../releases/download/untagged-<hash>/...`; only after publishing does
+      # the manifest point at the stable `.../releases/download/<tag>/...` path.
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
+          else
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
+          fi
+
       - name: Download release metadata
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -329,31 +343,6 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release upload "${GITHUB_REF_NAME}" release-check/latest.json --clobber
 
-      - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
-          else
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
-          fi
-
-      - name: Refresh published GitHub release metadata
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_id="$(
-            gh api "repos/${GITHUB_REPOSITORY}/releases" \
-              --paginate \
-              --jq ".[] | select(.tag_name == \"${GITHUB_REF_NAME}\") | .id"
-          )"
-          if [[ -z "$release_id" ]]; then
-            echo "Published release ${GITHUB_REF_NAME} was not found"
-            exit 1
-          fi
-          gh api "repos/${GITHUB_REPOSITORY}/releases/${release_id}" > release-check/release.json
-
       - name: Build Update Server artifact catalog
         run: |
           node scripts/axolotl/create-update-server-catalog.mjs \