Refactor release build to not require pre-published release

Our current release process is to create a release on Github, publish it, creating the associated tag, which triggers the build. This means that:

• when the release is published it has no build artefacts associated with it
• if the build fails for any reason, the release is left in a broken state
• we burn a tag for every attempt at rebuild

I think we need to reorganize things so that the build is triggered on tag creation and then iff the build succeeds a DRAFT release is created for the release manager to review and verify before publishing it.

Although the Github Actions file has

on:
  release:
    types: [created, published]

The Github documentation explicit says that creating draft releases won't trigger the workflow (but having both events listed means the workflow gets triggered twice when a non-draft release is created and published, which is something we don't want).

Reorganizing things in this fashion which will also allow us to run e2e tests as part of the release build (they are currently run, but ignored) since we don't have a high stakes build that basically has to succeed.