ci: release safety on main — draft-first promote + per-name asset verification - #4

busbar has no ref '4/merge', so the moving leg used busbar@dev instead. On a pull_request, `github.ref_name` is '<number>/merge' rather than a branch name, which is the usual cause: pass `busbar_ref: ${{ github.base_ref || github.ref_name }}` from the caller to say what you meant.