fix(release): let host smoke jobs read the draft release lock

Draft releases are visible only to tokens with push access, so the
supported-host smoke jobs' contents: read token could not download the
still-draft release lock via prepare-release-lock.ts, failing every
release before publication. Grant contents: write, matching the
publish-release job's existing draft-asset download, and pin the
permission in the deployment policy test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/release.yml

@@ -447,7 +447,9 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
     permissions:
-      contents: read
+      # The release is still a draft here, and draft releases are visible only to tokens with push
+      # access, so `gh release download` in prepare-release-lock.ts needs contents: write.
+      contents: write
       packages: read
     steps:
       - name: Check out the released tree

scripts/release-deployment-policy.test.ts

@@ -52,5 +52,8 @@ await test("release publication requires native smoke tests for every supported
 	assert.match(smokeGate, /architecture: arm64\n\s+runner: ubuntu-24\.04-arm/);
 	assert.match(smokeGate, /up -d --wait --wait-timeout 600/);
 	assert.match(smokeGate, /prepare-release-lock\.ts/);
+	// Draft releases are visible only to tokens with push access; a read-only token cannot
+	// download the still-draft release lock and would fail every smoke run.
+	assert.match(smokeGate, /contents: write/);
 	assert.match(release, /gh release upload "\$TAG_NAME" host-smoke\/\*\.json/);
 });