ci: gate release on a separate test job, least-privilege permissions

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira). (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Tighten permissions: top-level contents:read; write scoped to the release job.

Author: AlemTuzlak

.github/workflows/release.yml

@@ -12,25 +12,41 @@ env:
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
 
 permissions:
-  contents: write
-  id-token: write
-  pull-requests: write
+  contents: read
 
 jobs:
-  release:
-    name: Release
+  test:
+    name: Test
     if: github.repository_owner == 'TanStack'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          persist-credentials: true # release job pushes version/docs changes
+          persist-credentials: false
       - name: Setup Tools
         uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
       - name: Run Tests
         run: pnpm run test:ci
+
+  release:
+    name: Release
+    needs: test
+    if: github.repository_owner == 'TanStack'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+      - name: Setup Tools
+        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
       - name: Run Changesets (version or publish)
         id: changesets
         uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0