fix(ci): defer version-only promotions

[yansigit]

Summary

• Prevent the generated next-patch package version from opening a ready dev-to-main promotion PR when it is the only tree change.
• Preserve promotion for source, documentation, workflow, dependency metadata, and other package changes.
• Security review: workflow triggers and permissions are unchanged; the decision helper is loaded from the trusted main checkout; dev-controlled input is parsed only as filenames and JSON; promotion token minting is now more restrictive.

Verification

• bun run typecheck
• bun test tests/fork/dev-promotion-workflow.test.ts (10 passed)
• bun run privacy:scan
• Production-shape check against origin/main and origin/dev returned wait for the package.json-only 2.39.5 to 2.39.6 bump.
• bun run test completed with four unrelated proxy-liveness failures because the newly merged TLS fallback reached an already-running local OpenCodex service on port 10100 after the mocked HTTP request failed.
• bun run test:container reached the Apple Container build but its build context omitted the tracked nested bun.lock files from the temporary worktree.
• Required GitHub checks must pass for the exact head before merge.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No user-facing documentation change is required.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

PR automation (bot-owned)

• Class: draft (draft)
• Base: 6f66921ea76598ca19ac4ef48ae3bf989f538a46
• Head: 7b1c63655701007c5b65c614d2cd3ec01c709aaf
• Action: observed
• Exact-head gate: BLOCKED (not-mergeable, check-missing, check-not-success)
• Sensitive paths: .github/scripts/fork-promotion-decision.cjs, .github/workflows/promote-dev.yml
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: human review required

[github-actions]

✅ READY

• all PR quality gates passed.