Harden promotion policy execution

[mayankhansraj12]

Summary

• execute promotion validation from the trusted main-branch workflow with pull_request_target
• retain zero permissions and never check out pull-request code
• document the threat model and refresh the production audit date

Verification

• actionlint .github/workflows/*.yml
• YAML parsing
• git diff --check