fix(release): assert required release assets by presence in auto-promote

[joshua-temple]

Problem

The auto-promote "Verify published release" gate asserted an exact ASSET_COUNT = 5 ("4 archives + checksums.txt"). That count predates release signing and SBOMs (added in #395, with cosign migrated to the Sigstore bundle format in #459). A signed final release now publishes 11 assets, so the exact-count assertion would fail the final publish and block auto-promotion. v0.7.0 predates the signed path, so this had never been exercised against a real signed release.

Fix

Replace the brittle exact count with presence-based assertions on the load-bearing named assets:

• checksums.txt
• checksums.txt.bundle (cosign signature)
• checksums.txt.asc (GPG signature)
• at least 4 archive tarballs (*.tar.gz)

Each required asset is reported present/missing in the step summary, and a missing one sets fail=1 and exits 1. The presence loop is set -euo pipefail-safe (the jq -e membership test runs inside an if condition). The draft, prerelease, and latest-release checks are unchanged, and the change is scoped to this single step. Asserting by name keeps the gate stable as the artifact set grows (for example the per-archive SBOMs).

Verification

Enumerated the goreleaser output from goreleaser release --snapshot --clean --skip=publish,sign,sbom plus the .goreleaser.yaml signs/sboms config. Full published set (11):

• 4 archives: cascade_<ver>_{linux,darwin}_{amd64,arm64}.tar.gz
• checksums.txt
• checksums.txt.bundle (cosign, signs id cosign, signature: ${artifact}.bundle)
• checksums.txt.asc (gpg, signs id gpg)
• 4 per-archive SBOMs: cascade_<ver>_<os>_<arch>.sbom.spdx.json

actionlint .github/workflows/auto-promote.yaml: clean. Presence logic sanity-tested against mock release JSON: full set passes (fail=0), a set missing checksums.txt.bundle fails (fail=1).