feat(preflight): probe release and ghcr push access

A caller can grant narrower permissions than the release job needs. The
release then fails at the end, when it creates the tag or pushes an
image.

The preflight job now declares the same contents and packages
permissions as the release job and probes with the real token. A git
push dry run checks that the token can create the tag and release. A
ghcr.io token request and a blob upload session check that the token can
push the image. The upload session creates no package.

The release-cgo workflow probes ghcr only when the GoReleaser config
builds ghcr.io images. The release workflow probes it when
docker-enabled is true and the registry is ghcr.io. A probe that cannot
reach a verdict warns and does not fail.

.github/workflows/go-release-cgo.yaml

@@ -90,6 +90,9 @@ concurrency:
 jobs:
     preflight:
         name: Preflight
+        permissions:
+            contents: write
+            packages: write
         runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
         timeout-minutes: 5
         steps:
@@ -104,6 +107,8 @@ jobs:
               uses: lukaszraczylo/shared-actions/.github/actions/preflight@main
               with:
                   require: GITHUB_TOKEN,GORELEASER_KEY
+                  release-write: "true"
+                  ghcr-push: auto
                   repo-access: ${{ inputs.preflight-repos }}
                   repo-token-env: GITHUB_TOKEN
               env:

.github/workflows/go-release.yaml

@@ -63,6 +63,9 @@ concurrency:
 jobs:
   preflight:
     name: Preflight
+    permissions:
+      contents: write
+      packages: write
     runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
     timeout-minutes: 5
     steps:
@@ -77,6 +80,8 @@ jobs:
         uses: lukaszraczylo/shared-actions/.github/actions/preflight@main
         with:
           require: GITHUB_TOKEN
+          release-write: "true"
+          ghcr-push: ${{ inputs.docker-enabled && inputs.docker-registry == 'ghcr.io' && 'true' || 'false' }}
           repo-access: ${{ inputs.preflight-repos }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}