Fix release workflow branch policy env

.github/workflows/create-release.yml

@@ -131,6 +131,7 @@ jobs:
         env:
           VERSION: ${{ steps.extract.outputs.version }}
           TAG: ${{ steps.extract.outputs.tag }}
+          REQUIRED_BRANCH: ${{ steps.branch_policy.outputs.required_branch }}
           IS_PRERELEASE: ${{ steps.extract.outputs.is_prerelease }}
           PROMOTED_FROM_TAG_INPUT: ${{ github.event.inputs.promoted_from_tag }}
           ROLLBACK_VERSION_INPUT: ${{ github.event.inputs.rollback_version }}

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -167,6 +167,13 @@ rather than as release-candidate promises.
 Those same workflows must also fetch and dispatch the governed release branch
 derived from release-control metadata instead of hardcoding `pulse/v6`,
 `pulse/v6-release`, or any later branch literal inline.
+That same branch-policy contract must survive step boundaries inside the
+workflows themselves: `.github/workflows/create-release.yml` and
+`.github/workflows/release-dry-run.yml` must pass the resolved
+`steps.branch_policy.outputs.required_branch` value into the promotion-policy
+validation step environment before that step fetches refs or invokes
+`resolve_release_promotion.py`, rather than assuming a shell-local
+`REQUIRED_BRANCH` variable still exists from an earlier step.
 That same `internal/updates/` boundary now also owns runtime data-dir
 authority for temp, backup, and cleanup behavior: `manager.go` must resolve
 its working directories through the shared runtime data-dir helper instead of

scripts/release_control/release_promotion_policy_test.py

@@ -164,6 +164,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         resolver = read("scripts/release_control/resolve_release_promotion.py")
         self.assertIn("control_plane.py --branch-for-version", content)
         self.assertIn('git fetch --prune origin main "${REQUIRED_BRANCH}" --tags', content)
+        self.assertIn('REQUIRED_BRANCH: ${{ steps.branch_policy.outputs.required_branch }}', content)
         self.assertIn("resolve_release_promotion.py", content)
         self.assertIn("Rollback command:", content)
         self.assertIn("rollback target and exact reinstall command recorded", policy)