fix(release): allow promotion to verify draft

[jeremi]

What changed

• restore job-scoped contents: write for the image-promotion job
• add a focused regression test binding that permission to the live draft re-read immediately before public image access

Root cause

Publication run 31768565679 failed before registry login because the image-promotion job could not read the unpublished bound draft with a read-only GITHUB_TOKEN. GitHub returned 403 Resource not accessible by integration. A recent permission minimization had reintroduced this previously fixed failure.

The workflow-level default remains contents: read; the write permission is limited to the protected-main job that already promotes final images. Checkout credentials remain disabled.

Recovery

The existing immutable v0.22.0 tag and exact candidate remain valid. The failed run created an exact unpublished draft but wrote no final OCI, npm, PyPI, public release, or docs state. After this PR merges and protected-main CI passes, a new publication dispatch will reconcile that same tagged candidate and draft.

Validation

• 99 focused workflow, guard, and gate-inventory tests passed
• full release-script test discovery passed
• gate inventory passed for 151 gates
• targeted and full actionlint passed
• git diff --check passed
• independent least-privilege and recovery review found no issues

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68e1997cff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

The reviewed commit message has no Signed-off-by: trailer, so it violates the repository's requirement that every commit be created with git commit -s and will fail DCO enforcement. Recreate this commit with the required sign-off before merging.

AGENTS.md reference: AGENTS.md:L272-L275

Useful? React with 👍 / 👎.