Edit: this is easy, in fact: you make a copy of your 'publish' branch on the publishing site, call it 'draft', and then protect it.