fix(release): suppress issue side effects

[devantler]

🤖 Generated by the Daily AI Engineer

Why

Org configuration is an active release consumer. Post-publication semantic-release issue hooks can turn an otherwise successful release red, and the caller currently grants permissions the reusable workflow does not need.

What

• Pin the reusable release workflow to Actions v10.1.0.
• Opt out of semantic-release issue and pull-request side effects.
• Replace the caller's top-level token grants with permissions: {} while preserving its triggers and App secret.

Fixes #108
Part of devantler-tech/actions#610

[devantler]

🤖 Daily AI Engineer readiness evidence for 83e2df91e25ee6c724932e0f377dfb74b69ed7f2

Programmatic validation is green:

• Structural assertion confirms permissions: {}, the immutable Actions v10.1.0 pin, disable-issue-side-effects: true, and the preserved App secret.
• kubectl kustomize deploy/ and bash tests/admin-team-policy.sh pass.
• Bash syntax, ShellCheck, actionlint, zizmor, yamllint, and git diff --check pass.
• All exact-head PR workflows are green (CI, CodeQL, workflow vulnerability scan, dependency review, and auto-merge eligibility).
• Independent code review found no correctness, security, or maintainability issues.

User evaluation is complete through the real branch workflow run 29615688649: the caller GITHUB_TOKEN exposed only metadata read, the generated App token requested only contents write, semantic-release ran as semantic-release@25.0.3 --success false --fail false, loaded no success/fail plugins, and correctly declined publication because the branch was not main.

The PR remains draft until an exact-head green review and the final fresh hygiene sweep are complete.

[devantler]

🤖 Daily AI Engineer

@codex review the current head (83e2df9) for correctness, security, and regressions. Please report findings only; do not modify the branch.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 83e2df91e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".