Use immutable releases #2163
Description
When a release is created it produces a tag which triggers the build. The recommended download URL prefix https://github.com/pypa/hatch/releases/latest/download/ is broken for the duration of the build, see #2161.
Using immutable releases will improve security and force a workflow restructuring such that release builds create a prerelease and then the promotion of it requires a manual step in the UI.