fix(release): repair post-merge publication gates

[rynfar]

Problem

Two live post-merge publication gates fail on valid canonical evidence:

• Preview run 33539105762 requests branchProtectionRule with the default GITHUB_TOKEN, but GitHub requires unavailable Administration read access.
• Merged changelog run 33539105742 receives run.pull_requests: [] after the merged head branch is deleted.

Fix

Remove the Administration-gated branch-protection reads while retaining canonical repository, ref, live head, and direct exact-check proofs. Remove only the unstable Actions run pull-request-array predicate from merged changelog proof.

The unique merge-SHA-associated PR, exact PR base/head identity, check, app, suite, details-URL run id, workflow run, repository ids, and workflow path remain directly cross-bound. All five environment-only App-token REST and GraphQL ruleset audits remain exact and adjacent to their protected mutations.

Publication policy revision 2 records the new workflow bytes while preserving revision 1 for historical verification.

Verification

• npm run test:pylon-release — 10 passed
• npm run test:pylon-publication — 33 passed
• npm run test:pylon-ruleset-auditor-app — 6 passed
• npm run check
• actionlint on the changed workflows
• 31 inline github-script bodies compiled
• Workflow policy hashes and git diff --check verified

Model: OpenAI Codex GPT-5.6
Harness: Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}