Publish: verify the release's stored state after attaching the APK

A live publish on git.wallacenet.ca kept coming back invisible to the updater:
the create accepted "draft": false, and the release was still stored as a
draft once the APK was attached — so the anonymous list the app reads came
back empty even though every publish step reported success.

The script now attaches first, then reads the release back and PATCHes the
state if it did not stick, failing loudly if the correction is refused. A
draft is not a channel a preview build can silently become.

Also lists all 22 catalogue games in the README's table; seven were missing,
which read as "the app has 15 games".

Verified against the live instance: anonymous list shows
v1.4.1001-dev as a published prerelease with a tag-named asset, the
production /releases/latest correctly returns 404 while only a prerelease
exists, and an anonymous download through the URL the app builds matches the
built APK byte for byte.

Co-Authored-By: Paperclip <[email protected]>

scripts/publish-release.sh

@@ -86,6 +86,10 @@ fi
 id="$(grep -o '"id":[0-9]*' "$tmp/create.json" | head -n1 | tr -dc '0-9' || true)"
 [ -n "$id" ] || { echo "publish-release: no release id in response" >&2; cat "$tmp/create.json" >&2; echo >&2; exit 1; }
 
+# Attach the APK first, then check the stored state: uploading has been
+# observed to leave a freshly created release as a draft, whatever the create
+# response said, so the check has to be the last thing that happens rather
+# than a step in the middle.
 code="$(curl -sS -o "$tmp/asset.json" -w '%{http_code}' -X POST \
     -H "Authorization: token ${GITEA_TOKEN}" \
     -F "attachment=@${apk};filename=${apk_name}" \
@@ -98,4 +102,25 @@ if [ "$code" != "201" ] && [ "$code" != "200" ]; then
     exit 1
 fi
 
+# Read back what the database actually stored before declaring success. A draft
+# is invisible to the updater — exactly what a channel must not silently become
+# — and this instance has been seen to report one as published at create time
+# and store it as a draft by the time it is read.
+curl -sS -o "$tmp/stored.json" -H "Authorization: token ${GITEA_TOKEN}" "$api/releases/${id}"
+if grep -q '"draft":true' "$tmp/stored.json" ||
+    ! grep -q "\"prerelease\":${prerelease}" "$tmp/stored.json"; then
+    state="$(curl -sS -o "$tmp/fix.json" -w '%{http_code}' -X PATCH \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        -d "{\"draft\":false,\"prerelease\":${prerelease}}" \
+        "$api/releases/${id}")"
+    if [ "$state" != "200" ]; then
+        echo "publish-release: release ${tag} is stored with the wrong state (HTTP ${state})" >&2
+        cat "$tmp/fix.json" >&2
+        echo >&2
+        exit 1
+    fi
+    echo "publish-release: corrected the stored state of ${tag} (it was saved as a draft)"
+fi
+
 echo "publish-release: ${tag} -> release ${id} on ${api#*/repos/}, asset ${apk_name}"