Enable org Actions policy for Squad CI and releases

[igorcosta]

Remote workflows in autohandai/squad are currently blocked before any jobs are created.

Evidence:

• Workflow run 26428482497 on CI completed with conclusion startup_failure.
• The run has no jobs and no logs.
• Repository-level Actions are enabled and workflows are active.
• Attempting to set repository workflow token defaults to write failed with: Write permissions for workflows are disabled by the enterprise.
• The current CLI token cannot inspect org Actions policies without admin:org.

Acceptance criteria:

• Organization/enterprise Actions policy allows this private repo to use GitHub-hosted Linux, macOS, and Windows runners, or provides matching self-hosted runners.
• Release publishing has either GITHUB_TOKEN write permission or a configured release token secret.
• Rerun CI and verify Web checks, release metadata checks, runtime matrix checks, release dry-run matrix checks, and merged manifest validation pass.
• Rerun Release on main and verify canary prerelease artifacts publish.
• Run a stable tag/manual release test and verify stable artifacts publish.

[igorcosta]

CI/CD hardening update on 2026-05-26:\n\n- Pushed 8cc839e (Harden Squad release workflows).\n- Added Actions Smoke: a workflow_dispatch-only/read-only runner startup check with one echo step.\n- Release workflow now keeps default GITHUB_TOKEN read-only and requires AUTOHAND_RELEASE_TOKEN for publishing.\n- Local validation passed: bun run ci, plus release build/package/manifest merge for darwin-arm64.\n\nCurrent blocker is external to the workflow jobs:\n\n- Push run: https://github.com/autohandai/squad/actions/runs/26429519924\n - conclusion=startup_failure\n - workflowName empty\n - path=BuildFailed\n - jobs=[]\n- Manual smoke run: https://github.com/autohandai/squad/actions/runs/26429566720\n - workflowName=Actions Smoke\n - conclusion=startup_failure\n - jobs=[]\n - logs endpoint returns 404 because no job was created.\n\nRepo-level Actions permissions are enabled and allowed_actions=all. Default workflow permissions are read-only. Inspecting org Actions policy requires admin:org or org Actions policy permissions, which this token does not have. Next admin action: check org/enterprise Actions policy and billing/spending state so GitHub-hosted jobs can start.

[igorcosta]

Additional repo-governance evidence:\n\n- Channel environments exist: canary, beta, stable. Protection rules are currently empty.\n- Branch protection API for main returns 403: 'Upgrade to GitHub Pro or make this repository public to enable this feature.'\n\nSo there are two account/org-level release-readiness items outside this repo's code: enable private-repo branch protection on the plan, and fix the Actions startup policy/billing issue.

[igorcosta]

Follow-up CI/CD hardening update on 2026-05-26:\n\n- Pushed 97ca4fa (Tighten Squad release metadata).\n- Added .github/release.yml for categorized generated release notes.\n- Release packager now defaults generated asset URLs to autohandai/squad outside CI.\n- Release metadata now rejects invalid channels and malformed prerelease versions before asset publication.\n- Existing beta/canary release edits now also pass --latest=false, not only creates.\n- Local validation passed again: bun run ci, YAML parse for all workflow config, and manifest URL verification.\n\nRemote result remains the same external startup blocker:\n\n- Push run: https://github.com/autohandai/squad/actions/runs/26429719255\n - conclusion=startup_failure\n - workflowName empty\n - jobs=[]\n- Manual Actions Smoke run: https://github.com/autohandai/squad/actions/runs/26429730009\n - workflowName=Actions Smoke\n - conclusion=startup_failure\n - jobs=[]\n\nRepo-level Actions still reports enabled=true and allowed_actions=all; default workflow permissions are read-only. This confirms the repo code is not reaching a runner. An org/admin-side Actions or billing policy change is required before remote CI/CD can be proven green.