test(release): pin the missing-checksum gate; docs drop the manual publish step

The guard now proves the job exits on a missing platform before it
rewrites the notes or publishes, so removing that exit fails CI.
RELEASING.md's end-to-end updater test still said to publish the draft by
hand; the workflow publishes it.

docs/RELEASING.md

@@ -138,7 +138,7 @@ You should see platform-keyed download URLs + minisign signatures. If that JSON
 
 **Option B — full end-to-end:**
 1. Install v0.1.0 on a fresh machine (or clean-installed Applications).
-2. Cut v0.2.0 (bump, tag, push, wait for CI, publish draft).
+2. Cut v0.2.0 (bump, tag, push, wait for CI; the workflow publishes the release).
 3. Launch the installed v0.1.0. Within seconds, the dialog should appear.
 4. Accept → app downloads, verifies, replaces, relaunches as v0.2.0.
 

tests/test_release_checksum_notes.py

@@ -54,3 +54,12 @@ def test_only_that_job_publishes():
 
 def test_the_contributors_strip_edits_the_notes_after_them():
     assert "needs: [build, release-notes-checksums]" in _job("contributors-strip")
+
+
+def test_a_missing_platform_stops_before_the_notes_or_the_publish():
+    """A release missing one platform's checksums must stay a draft: the job
+    exits before it rewrites the notes or publishes anything."""
+    job = _code(_job("release-notes-checksums"))
+    assert "missing=1" in job
+    gate = job.index('[ "$missing" = 0 ] || exit 1')
+    assert gate < job.index("--notes-file") < job.index("--draft=false")