fix(release): allow draft asset smoke access

.github/workflows/create-release.yml

@@ -1289,7 +1289,10 @@ jobs:
       - validate_release_assets
     if: ${{ always() && needs.prepare.result == 'success' && needs.create_release.result == 'success' && needs.validate_release_assets.result == 'success' && needs.prepare.outputs.historical_asset_backfill_only != 'true' && github.event.inputs.draft_only != 'true' }}
     permissions:
-      contents: read
+      # GitHub's release API requires write-level repository access to read
+      # assets from an unpublished draft release. The called workflow only
+      # performs GET requests, but a read-scoped GITHUB_TOKEN receives 403.
+      contents: write
     uses: ./.github/workflows/install-sh-smoke.yml
     secrets: inherit
     with:

.github/workflows/install-sh-smoke.yml

@@ -94,6 +94,10 @@ jobs:
   smoke:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
+    permissions:
+      # Unpublished draft release metadata and assets are unavailable to a
+      # read-scoped GITHUB_TOKEN even though this job only performs GETs.
+      contents: write
     steps:
       - name: Checkout repository (for README key extraction)
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3