ci(release): enforce reusable permission ceiling (#110353)

.github/workflows/full-release-validation.yml

@@ -389,7 +389,8 @@ jobs:
     permissions:
       actions: read
       contents: read
-      packages: write
+      packages: read
+      pull-requests: read
     uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
     with:
       ref: ${{ needs.resolve_target.outputs.sha }}

test/scripts/release-no-push-workflow.test.ts

@@ -207,6 +207,7 @@ describe("release validation no-push transport", () => {
 
   it("keeps every local reusable-workflow permission request within its caller ceiling", () => {
     const readOnlyCalls = [
+      [FULL_RELEASE, "prepare_release_candidate"],
       [PLUGIN_PRERELEASE, "plugin-prerelease-docker-suite"],
       [RELEASE_CHECKS, "live_repo_e2e_release_checks"],
       [RELEASE_CHECKS, "docker_e2e_release_checks"],