chore: keep only W23 sample public, stop publishing runs to a public branch

.github/workflows/cron.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  contents: write
+  contents: read
   issues: write
 
 jobs:
@@ -32,17 +32,18 @@ jobs:
         run: pnpm pipeline --profile examples/sai-voice
       # Cost is capped in the engine (budgets.cost_usd_per_run, mid-run abort) and
       # run stats land in Supabase, so there is no data/runs summary to assert here.
-      # main is branch-protected (required CI check), so generated drafts are
-      # archived to the unprotected weekly-drafts branch, not committed to main.
-      - name: archive drafts to weekly-drafts
+      # Drafts are NOT published to any public branch. They are kept as a private
+      # CI artifact (visible to repo collaborators only); run stats land in Supabase.
+      - name: upload drafts (private artifact)
         if: always()
-        run: |
-          git config user.name "linkedin-engine-bot"
-          git config user.email "bot@users.noreply.github.com"
-          git add drafts/ posted/ || true
-          git diff --cached --quiet && echo "no draft changes" && exit 0
-          git commit -m "chore: weekly pipeline run [skip ci]"
-          git push -f origin HEAD:refs/heads/weekly-drafts
+        uses: actions/upload-artifact@v4
+        with:
+          name: weekly-drafts
+          path: |
+            drafts/
+            posted/
+          retention-days: 30
+          if-no-files-found: ignore
       - name: upload logs
         if: always()
         uses: actions/upload-artifact@v4

README.md

@@ -121,7 +121,7 @@ pnpm pipeline --profile examples/my-voice
 ## Demo
 
 - Demo profile: [`examples/sai-voice`](./examples/sai-voice)
-- A recent run's drafts: [`drafts/`](./drafts) (the cron archives fresh drafts to the [`weekly-drafts`](https://github.com/Imasaikiran/linkedin-engine/tree/weekly-drafts/drafts) branch, keeping `main` protected)
+- A sample week of drafts: [`drafts/2026-W23`](./drafts/2026-W23) (each scheduled run keeps its drafts as a private CI artifact, not a public branch)
 - Public Langfuse trace: [a real run, span per node](https://cloud.langfuse.com/trace/1e5a5622cf85438f2b45e7f50bf983de)
 
 ## Design docs