fix(ci): grant id-token: write to release.yml's edge-images job

[Weegy]

Summary

release.yml's edge-images job (push-to-main → :edge + :sha-<short> Docker images) calls the reusable publish-images.yml workflow, which requires id-token: write for keyless cosign signing (spec §10, added at some point after this job was written). A reusable workflow cannot self-grant that permission — the caller must. edge-images was never updated when that requirement landed, while auto-release.yml's equivalent publish-images job (for versioned releases) already grants it correctly.

Result: GitHub rejects the workflow file at parse time —

Error calling workflow '.../publish-images.yml@<sha>'. The workflow is
requesting 'id-token: write', but is only allowed 'id-token: none'.

Checked all Release-workflow runs on main: this has been startup_failure on every push to main since 2026-07-12 (c627c3c) — 15 days, no :edge image has published.

Fix

Add id-token: write to edge-images's permissions: block — the exact same line + comment already used in auto-release.yml's publish-images job (confirmed no other caller of publish-images.yml is missing it).

Test plan

• Diffed against auto-release.yml's working publish-images job — identical permission set
• Confirmed the only two callers of publish-images.yml in the repo, both now consistent
• CI green on this PR (only touches a workflow YAML file, no build-affecting checks expected to change)
• Merge and confirm the next push-to-main successfully runs edge-images end-to-end (can't be verified pre-merge since release.yml only triggers on push to main)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}