chore(ci): Release 带更新说明并移除 CNB 源码镜像

- build-on-tag.yml 改为三段式：preflight 从 announcement catalog
  生成中英双语更新说明并创建带说明的 draft release，build 各平台
  仅上传产物，publish 在所有平台完成后把 draft 转为正式发布。
- 移除 sync-cnb-source.yml：不再向 CNB 镜像源码（避免打 tag 时
  触发额外流水线，以及默认上游仓库带来的误推风险）。
- catalog.ts 新增 1.0.1-beta1 版本公告，作为该版本 Release 说明
  的来源。

.github/workflows/build-on-tag.yml

@@ -16,8 +16,63 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # 先生成该版本的更新说明（来自 announcement catalog）并创建带说明的 draft
+  # release；随后各平台 build 只负责上传产物，最后由 publish 转正。
+  preflight:
+    name: Prepare release
+    runs-on: ubuntu-24.04
+    env:
+      SQLX_OFFLINE: true
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
+
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate release notes
+        run: node scripts/axolotl/create-release-notes.mjs "${GITHUB_REF_NAME}" "${RUNNER_TEMP}/release-notes.md"
+
+      - name: Create draft release with notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          release_notes="${RUNNER_TEMP}/release-notes.md"
+          existing_release="$(
+            gh release list --limit 100 --json tagName \
+              --jq ".[] | select(.tagName == \"${GITHUB_REF_NAME}\") | .tagName"
+          )"
+          if [[ -n "$existing_release" ]]; then
+            echo "Release ${GITHUB_REF_NAME} already exists"
+            gh release edit "${GITHUB_REF_NAME}" --notes-file "$release_notes"
+            exit 0
+          fi
+
+          release_args=(
+            --draft
+            --notes-file "$release_notes"
+            --title "Starlight Launcher ${GITHUB_REF_NAME}"
+          )
+          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
+            release_args+=(--prerelease)
+          fi
+          gh release create "${GITHUB_REF_NAME}" "${release_args[@]}"
+
   build:
     name: Build (${{ matrix.name }})
+    needs: preflight
     strategy:
       fail-fast: false
       max-parallel: 4
@@ -111,8 +166,7 @@ jobs:
           tauriScript: pnpm tauri
           args: ${{ matrix.args }}
           tagName: ${{ github.ref_name }}
-          releaseName: Starlight Launcher ${{ github.ref_name }}
-          releaseDraft: false
+          releaseDraft: true
           prerelease: ${{ contains(github.ref_name, '-') }}
           generateReleaseNotes: false
           includeUpdaterJson: false
@@ -203,4 +257,19 @@ jobs:
             gh release upload "${{ github.ref_name }}" "$zipPath" --clobber
           } else {
             throw "Binary not found at $appExe"
-          }
+          }
+  # 所有平台构建完成后，把 preflight 创建的 draft release 转为正式发布。
+  publish:
+    name: Publish release
+    needs: build
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
+          else
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
+          fi

.github/workflows/sync-cnb-source.yml

@@ -1,69 +0,0 @@
-name: Sync source to CNB
-
-on:
-  push:
-    branches:
-      - '**'
-    tags:
-      - '**'
-  delete:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: sync-cnb-source-${{ github.event_name == 'delete' && format('{0}/{1}', github.event.ref_type, github.event.ref) || github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  sync:
-    name: Sync Git ref
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - name: Check out source
-        if: ${{ github.event_name != 'delete' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          filter: blob:none
-
-      - name: Push Git ref to CNB
-        env:
-          CNB_REPO_URL_HTTPS: ${{ secrets.CNB_REPO_URL_HTTPS }}
-          CNB_TOKEN: ${{ secrets.CNB_TOKEN }}
-          CNB_TOKEN_USER_NAME: ${{ secrets.CNB_TOKEN_USER_NAME }}
-          DELETED_REF: ${{ github.event.ref }}
-          DELETED_REF_TYPE: ${{ github.event.ref_type }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${CNB_TOKEN:-}" ]]; then
-            echo "CNB_TOKEN is not configured"
-            exit 1
-          fi
-
-          cnb_url="${CNB_REPO_URL_HTTPS:-https://cnb.cool/axlmc/Axolotl.git}"
-          token_user="${CNB_TOKEN_USER_NAME:-cnb}"
-          auth="$(printf '%s:%s' "$token_user" "$CNB_TOKEN" | base64 -w0)"
-          git_cnb() {
-            git -c "http.extraHeader=Authorization: Basic $auth" "$@"
-          }
-
-          if [[ "$GITHUB_EVENT_NAME" == "delete" ]]; then
-            git init
-            if [[ "$DELETED_REF_TYPE" == "tag" ]]; then
-              ref="refs/tags/$DELETED_REF"
-            else
-              ref="refs/heads/$DELETED_REF"
-            fi
-            git_cnb push "$cnb_url" --delete "$ref"
-          else
-            if [[ "$GITHUB_REF" == refs/tags/* ]]; then
-              git fetch --force origin "$GITHUB_REF:$GITHUB_REF"
-              source_ref="$GITHUB_REF"
-            else
-              source_ref="HEAD"
-            fi
-            git_cnb push --force "$cnb_url" "$source_ref:$GITHUB_REF"
-          fi