ci: switch ISO publish from artifacts to GitHub Releases

Artifact storage quota (50GB Pro tier) maxed out with ~18 iterations
of 2.7GB ISOs. Quota recalc 6-12h not in our cadence. Builds succeed
but upload step fails — wasting CI minutes + blocking testing.

Switch to GitHub Releases (no storage quota):
- Every successful build on main updates rolling `ci-latest`
  prerelease draft. Replaces files in place.
- Tag-driven releases (v*.*.*) keep their existing publish path.
- Build logs remain as artifacts (small + opt-in failure only,
  retention=1d).

User can `gh release download ci-latest --repo veilor-org/veilor-os`
or browse to releases page. No more artifact quota wall.

.github/workflows/build-iso.yml

@@ -165,15 +165,28 @@ jobs:
             sha256sum "$ISO_NAME" > "$ISO_NAME.sha256"
             ls -lh "$ISO_NAME"
 
-      - name: Upload ISO artifact
+      # ── ISO publish ────────────────────────────────────────────────────
-        if: success()
+      # Use GitHub Releases (not Actions artifacts) for ISO storage.
-        uses: actions/upload-artifact@v4
+      # Reason: artifact quota maxed at 50GB on Pro tier with ~18 ISOs.
+      # Releases have effectively unlimited storage per public/private repo.
+      # On every successful build of main, update the rolling `ci-latest`
+      # prerelease draft. Tag releases (`v*.*.*`) get a separate proper
+      # release. Build logs stay as artifacts (they're tiny + opt-in only
+      # on failure).
+      - name: Publish ISO to ci-latest rolling prerelease
+        if: success() && github.ref == 'refs/heads/main'
+        uses: softprops/action-gh-release@v2
         with:
-          name: veilor-os-iso
+          tag_name: ci-latest
-          path: |
+          name: "ci-latest (auto)"
+          body: |
+            Rolling auto-build from `main`. Latest commit: ${{ github.sha }}.
+            Replaces on every push. Not a stable release — for testing only.
+          prerelease: true
+          make_latest: false
+          files: |
             build/out/*.iso
             build/out/*.sha256
-          retention-days: 3
 
       - name: Upload build log on failure
         if: failure()
@@ -183,8 +196,9 @@ jobs:
           path: |
             build/out/build.log
             build/out/build/anaconda/
+          retention-days: 1
 
-      - name: Attach to release
+      - name: Attach to release on tag
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@v2
         with: