fix: set contents:write and --tag alpha in alpha publish plumbing

- Grant contents:write permission so Changesets can push git tags
- Add --tag alpha to changeset publish so alpha releases use the
  alpha npm dist-tag instead of overwriting latest
- Update docs to remove the incorrect claim that --tag alpha
  is unnecessary during prerelease mode

Author: mahyarmlk

.github/workflows/publish-alpha.yml

@@ -6,7 +6,7 @@ on:
 concurrency: ${{ github.workflow }}
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   publish-alpha:

docs/Release-Readiness.md

@@ -225,7 +225,7 @@ Key rules:
   - Version Packages PRs must not bump packages to stable versions.
   - Stable versions are only allowed after intentionally exiting prerelease mode via `pnpm changeset pre exit`.
   - The GitHub Actions PR creation setting (`GITHUB_TOKEN` permissions for creating and approving PRs) may need manual enabling after alpha versioning is fixed.
-  - While the repo is in Changesets alpha prerelease mode, `release:alpha` must run `changeset publish` without `--tag alpha`. The alpha dist-tag is derived from `.changeset/pre.json`.
+  - `release:alpha` must run `changeset publish --tag alpha` so the published packages use the `alpha` npm dist-tag instead of overwriting `latest`.
 
 ### Validation gates
 

package.json

@@ -8,7 +8,7 @@
     "lint": "tsc -p tsconfig.typecheck.json",
     "changeset": "changeset",
     "version:packages": "changeset version",
-    "release:alpha": "pnpm build && pnpm pack:check && changeset publish",
+    "release:alpha": "pnpm build && pnpm pack:check && changeset publish --tag alpha",
     "pack:check": "pnpm -r --filter @intent-framework/core --filter @intent-framework/dom --filter @intent-framework/router --filter @intent-framework/testing exec npm pack --dry-run",
     "dev:web-basic": "pnpm --dir examples/web-basic dev",
     "dev:canonical": "pnpm --dir examples/canonical-invite dev"