fix(ci): stop Release fan-out and false failures, correct workflow drift #599

Problem

Release fan-out and false failures. release.yml listens to workflow_run completion of Zsh, ZD Integration, CodeQL and Trunk Code Quality on every branch. From 2026-09-15 to 2026-10-07 it produced 149 runs, 134 of them skipped. Each promotion runs the publish job once per completed workflow: four times for 76a1a3d. On a legitimate non-promotion commit to main, 4f2c0a7 (#572), the automatic job failed five times with commit is not a merged next-to-main promotion instead of recording that there is nothing to publish. A red Release run on main that means "nothing to do" teaches people to ignore red.

Workflow drift found in the same review:

• promotion-readiness.yml labels checkout SHA 3d3c42e as # v4, while the same SHA is # v7.0.1 in every other workflow; its trunk-action pin has no version comment.
• release-plan.yml grants pull-requests: write to the whole workflow, although only the plan job writes the comment.
• commit-lint.yml grants pull-requests: read, which no step uses; its jobs read only the event payload and the checkout.
• benchmark.yml cites ADR-0009 for "observed, not gated"; the benchmark policy is ADR-0024 in z-shell/.github.
• CODEOWNERS lists /.github/dependabot.yml and /.github/copilot-instructions.md, which do not exist on next.

Not in scope here: Public Contract Evidence has failed on all three scheduled runs since 2026-09-21 because consumer pins are stale. The fix there is a maintainer re-review of the pins, or a decision to report through an issue instead of a red run.

Change

• Limit the workflow_run trigger to branches: [main], so other branches no longer create skipped Release runs.
• Keep publication gated exactly as now. ADR-0028 point 3 says the publisher fails closed when the merge is not a real promotion: it must never publish then, and that does not change. But a commit that reaches main through a sanctioned non-promotion path (a hotfix-* or Dependabot security pull request, which main-branch-guard.zsh admits) is not an anomaly. Have that case end successfully with a summary that says there is nothing to publish. Keep failing on real anomalies: main moved, validation incomplete or failed, mismatched promotion parents, an unexpected tag.
• Correct the pin comments, scope the permissions to the jobs that use them, fix the ADR citation, and remove the stale CODEOWNERS paths.