ci/cd: install fonts for the font-backend test; CD publishes drafts

- the Arch (and Debian/Fedora) containers carried no system fonts, so
  the effectchain font-family test failed with "the font backend found
  no families": install dejavu (ttf-dejavu / dejavu-sans-fonts /
  fonts-dejavu-core) on every Linux entry;
- the release job now creates a DRAFT release: a human reviews the assets
  and publishes deliberately, and a published version is never silently
  replaced (the repo also protects v* tags from being moved).

.github/workflows/cd.yml

@@ -176,7 +176,7 @@ jobs:
             libasound2-dev libpulse-dev libsndfile1-dev \
             libgl1-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers \
             libvulkan-dev libxkbcommon-dev libxkbcommon-x11-dev xvfb libdrm-dev \
-            icc-profiles-free gdb file librsvg2-bin patchelf \
+            icc-profiles-free gdb file librsvg2-bin patchelf fonts-dejavu-core \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (Fedora)
@@ -198,7 +198,7 @@ jobs:
             rpm-build librsvg2-tools libdrm-devel \
             perl-IPC-Cmd perl-FindBin perl-File-Basename perl-File-Compare \
             perl-File-Copy perl-File-Path perl-File-Temp perl-Time-Piece \
-            xorg-x11-server-Xvfb xorg-x11-xauth gdb file \
+            xorg-x11-server-Xvfb xorg-x11-xauth gdb file dejavu-sans-fonts \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (Arch)
@@ -211,7 +211,7 @@ jobs:
             pipewire jack2 alsa-lib libpulse libsndfile \
             mesa vulkan-headers vulkan-icd-loader \
             libxkbcommon libxkbcommon-x11 librsvg libdrm \
-            xorg-server-xvfb xorg-xauth gdb file \
+            xorg-server-xvfb xorg-xauth gdb file ttf-dejavu \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (openKylin)
@@ -479,5 +479,8 @@ jobs:
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
-          draft: false
+          # Drafts only: a human reviews the assets and publishes the
+          # release deliberately (a published version must not be silently
+          # replaced, and the repo protects v* tags from being moved).
+          draft: true
           files: artifacts/*

.github/workflows/ci.yml

@@ -179,7 +179,7 @@ jobs:
             libasound2-dev libpulse-dev libsndfile1-dev \
             libgl1-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers \
             libvulkan-dev libxkbcommon-dev libxkbcommon-x11-dev xvfb libdrm-dev \
-            icc-profiles-free gdb file librsvg2-bin patchelf \
+            icc-profiles-free gdb file librsvg2-bin patchelf fonts-dejavu-core \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (Fedora)
@@ -201,7 +201,7 @@ jobs:
             rpm-build librsvg2-tools libdrm-devel \
             perl-IPC-Cmd perl-FindBin perl-File-Basename perl-File-Compare \
             perl-File-Copy perl-File-Path perl-File-Temp perl-Time-Piece \
-            xorg-x11-server-Xvfb xorg-x11-xauth gdb file \
+            xorg-x11-server-Xvfb xorg-x11-xauth gdb file dejavu-sans-fonts \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (Arch)
@@ -214,7 +214,7 @@ jobs:
             pipewire jack2 alsa-lib libpulse libsndfile \
             mesa vulkan-headers vulkan-icd-loader \
             libxkbcommon libxkbcommon-x11 librsvg libdrm \
-            xorg-server-xvfb xorg-xauth gdb file \
+            xorg-server-xvfb xorg-xauth gdb file ttf-dejavu \
             autoconf autoconf-archive automake libtool
 
       - name: Install system dependencies (openKylin)