fix: grant chart release caller artifact access

[rusenask]

GitHub rejected the tag workflow at compile time because the reusable chart publisher requests actions: read while its caller explicitly reduced that permission to none. Grant the caller read-only artifact access and cover the caller/callee contract in the release workflow fixture.

No release job started and no registry/chart/release mutation occurred in failed run 34369483030.

Validation:

• make release-workflow-test
• actionlint

---

Note

Low Risk
CI-only permission wiring for the release pipeline; no runtime operator or chart behavior changes.

Overview
Tag releases were failing before any jobs ran because the reusable chart-release.yml workflow requires actions: read (for artifacts), while the chart-publication caller job did not grant that permission—GitHub rejects that permission mismatch at workflow compile time.

This change adds actions: read to the chart-publication job in release.yml, alongside the existing contents: read and id-token: write, so the caller satisfies the reusable workflow contract.

The release workflow fixture in .test/release-workflow.sh now asserts that chart-publication includes actions: read, locking in the caller/callee expectation.

^{Reviewed by Cursor Bugbot for commit 10f2286. Configure here.}