SW-112 — Add release workflow permission regression tests

[dDevAhmed]

Summary

Verify release workflow write/OIDC permissions remain limited to intended protected jobs.

Acceptance Criteria

• version/publish permission envelopes are asserted;
• PR/read-only jobs cannot gain release permissions;
• OIDC stays publish-only;
• repository checks pass.

Dependencies

• SW-105
• SW-111

---

🏷 Labels

• Stellar Wave
• type: security
• area: release
• priority: P0
• difficulty: high
• points: 200
• workstream: release
• supply-chain
• protected-surface