Fix immutable-release preflight permission boundary

[moloch--]

Summary

The v0.0.1 tag build stopped before signing because GitHub documents the immutable-releases settings endpoint as requiring repository Administration read permission. A workflow GITHUB_TOKEN cannot receive that permission, so the endpoint returned 403 Resource not accessible by integration.

Keep the actual security boundary explicit:

• immutable releases remain enabled and were verified through the admin CLI before deployment approval
• signing remains behind the protected armory-release reviewer gate
• the workflow still requires the published release to report immutable == true
• no key was read and no draft release was created by the failed run

Validation

• actionlint v1.7.12
• git diff --check
• exact failed job and endpoint permission reviewed

[moloch--]

Retriggering the pull_request event because GitHub did not create check suites for the initial opened event.