fix(ci): qualify reusable release operations

[f0rr0]

Summary

• grant every top-level reusable-workflow caller the compile-time permission ceiling required by its nested operations
• split dry-run and publish execution so dry-run receives read-only permissions while publish alone receives write/OIDC scopes
• enforce the caller ceiling, least-privilege split, shared step identity, and mutation boundaries in policy tests
• document the reusable-workflow permission model and recovery behavior

Evidence

• GitHub server compiler probe materialized the complete reusable-workflow graph successfully
• actionlint passed
• workflow semantics: 19/19 passed
• release topology: 6/6 passed
• full release check passed
• full workflow policy suite passed, including zizmor and toolchain/setup tests

This PR is a disposable qualification vehicle. After checks pass, the tree will be folded into the signed introduction commit to preserve the authorized two-commit main history.

[f0rr0]

Qualification evidence completed successfully in run 29788007001. The identical tree is now the signed, fully qualified introduction commit on main; this transport PR must not be merged.