fix: hand resolved version-under-test to auto-promote via artifact

[joshua-temple]

Problem

Auto-promote on green fleet derives the rc version from workflow_run.head_branch. When the fleet is dispatched on main with -f cascade_version=vX.Y.Z-rc.N (the documented trigger), head_branch is main, not the rc tag, so the rc-shape gate fails and promote=false. A fully green fleet then silently skips promotion. A workflow_run does not inherit the triggering run's dispatch inputs, so the validated version is known only inside the fleet run.

Fix

Carry the resolved version-under-test across the workflow_run boundary as a build artifact.

• fleet-e2e.yaml (resolve job): write the exact resolved $VERSION (the value every suite is pinned to) to version-under-test.txt and upload it as the version-under-test artifact.
• auto-promote.yaml (resolve job): download that artifact from the triggering run (run-id, github-token) and read it as the authoritative rc. Fall back to the existing head_branch / head_sha -> tag lookup only when the artifact is absent (back-compat for a tag-push-triggered fleet). The rc-shape gate (^vX.Y.Z-rc.N$) is unchanged, so a missing/invalid version stays a clean promote=false no-op. Added actions: read is required for the cross-run artifact download.

Actions pinned by SHA to match repo style: upload-artifact v7.0.1 (existing pin), download-artifact v5.0.0.

Verification

• actionlint clean on both workflows.
• go build ./... ok, golangci-lint run ./... 0 issues, e2e module builds. All go test ./... pass except TestNormalizeWorkflowPath_ActionlintClean, which fails identically on clean main (a local actionlint path-resolution artifact, unrelated to this change).