Fix release workflow startup permissions

[IchenDEV]

Cause

Six scheduled Nightly runs stopped with startup_failure before a job began. GitHub's annotation on run #35888630166 reports that the called release job requests contents: write while the Nightly caller allows only contents: read. The tag-triggered caller has the same mismatch.

Fix

• Grant contents: write only to each caller's release job. Planning and validation retain the read-only workflow default.
• Extend the existing workflow wiring test to fail on the old mismatch in either entry point.
• Record the high-risk release change and rollback in the SDLC bundle.

Verification

• Regression test failed on the old caller permissions and passed after the fix.
• bash scripts/sdlc-checks.sh passed.
• bash scripts/ci-basic-checks.sh passed.
• swift test --scratch-path /tmp/utter-silent-insertion-build passed: 793 XCTest cases, 18 skipped, zero failures, plus one Swift Testing case.
• GitHub compare reports this branch ahead of main with no commits behind.
• GitHub PR checks passed at 3f66dda: Contract & Tests, Release-style App Build, and SDLC Gate. GitHub reports MERGEABLE.

The PR does not create a tag or publish a release. A real Nightly startup, independent review, and protected production approval remain separate acceptance steps.