Fix draft visibility in 0.9.2 promotion job

[N0ahTM]

Why

The v0.9.2 promotion run stopped after SBOM and attestation validation because the validate-promotion job could not read the unpublished GitHub Release with contents: read (gh release view v0.9.2 returned release not found). No public release or Store submission was made.

Change

Grant contents: write only to validate-promotion, which needs push access to inspect the draft. The tag, tagged source and release assets remain unchanged.

Validation

• Parsed the workflow YAML and checked the patch for whitespace errors.
• Verified all ten draft assets locally against the immutable successful tag-build artifact: 109,041,546 bytes matched by SHA-256.
• This PR does not alter product code or package contents.