ci(release): sync develop release.yml + fix dispatch-token perms

[bpamiri]

Summary

Reconciles develop's release.yml with the main hotfix and corrects the dispatch-token permission docs.

• Port FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 + workflow_dispatch from ci(release): force Node 24 for JS actions + add workflow_dispatch #2820 (currently main-only). Without this, the next develop→main release would merge develop's older release.yml over main's and silently drop the Node 24 fix — so 4.0.3 would hit the same Argument list too long failure that blocked 4.0.2 (Release 4.0.2 #2819). This makes develop's release.yml a superset of main's, so future release merges stay conflict-free.
• Fix token-permission comments (actions: write → contents: write) for both DOWNSTREAM_DISPATCH_TOKEN and LINUX_REPO_DISPATCH_TOKEN. POST /repos/{owner}/{repo}/dispatches requires contents: write for fine-grained PATs — the mis-documented permission is exactly why LINUX_REPO_DISPATCH_TOKEN was scoped actions: write and 403'd on the 4.0.2 apt/yum dispatch.

Test plan

• release.yml valid YAML; triggers: push, workflow_dispatch, workflow_call
• CI green (commitlint + fast-test)

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR: A targeted CI-only diff that forward-ports two fixes from main's hotfix into develop's release.yml and corrects two token-permission comments. The changes are accurate, well-documented, and safe to merge. Approve.

---

Correctness

All three changes check out:

1. workflow_dispatch trigger — correctly placed in the on: block between push and workflow_call. No inputs: block is needed for a simple manual re-trigger (the channel/version path already keys on GITHUB_REF, as the comment explains). Consistent with the pattern on main after #2819.

2. FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true — a valid GitHub runner env var that routes JS actions through the Node 24 runtime. The existing WHEELS_PRERELEASE: false in the same block is also a YAML boolean, so the pattern is consistent and GitHub Actions handles the bool-to-string coercion correctly. The inline comment fully documents the why (Wandalen/wretry.action, forced migration deadline 2026-06-02, #2819).

3. Permission comment corrections — contents: write is the correct fine-grained PAT permission for POST /repos/{owner}/{repo}/dispatches. actions: write does not cover repository dispatch; this mis-documentation is what led to the 403 on the apt/yum dispatch during 4.0.2. Both comment sites (lines 558 and 624) are now accurate.

No code paths, branches, or edge cases are missed — this is a pure YAML/comment change with no runtime logic.

---

Commits

ci(release): sync develop release.yml + fix dispatch-token perms — valid type (ci), optional scope (release), subject under 100 chars, sentence-case. Passes commitlint.

---

No cross-engine, conventions, tests, docs, or security sections apply — the only file touched is .github/workflows/release.yml.

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review checks out. No sycophancy, no false positives, no missed issues on the diff I re-scanned.

Sycophancy

None detected. A's "approve" is backed by line-by-line verification of all four hunks.

False positives

None detected. All three claims verified against the diff:

• workflow_dispatch placement in the on: block is correct; no inputs: block is needed for a ref-keyed re-trigger.
• FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true as an unquoted YAML boolean is fine — GitHub Actions coerces it to the string "true"; WHEELS_PRERELEASE: false in the same block already uses the same pattern.
• contents: write is the correct fine-grained PAT permission for POST /repos/{owner}/{repo}/dispatches; actions: write does not cover it.

Missed issues

None detected. DCO sign-off (Signed-off-by: Peter Amiri) is present on the commit. Commitlint passes. No cross-engine, runtime, or security surface touched — purely .github/workflows/release.yml.

Verdict alignment

A's approve is consistent with the findings.

Convergence

Aligned. This is a YAML-and-comment-only change with no runtime logic; all facts A cited are accurate. Joint recommendation: approve and merge.