Security fix
- /publish and /save-draft REST endpoints now derive the correct capability (publish_posts / edit_posts) from the target post's actual post type via get_post_type_object(), instead of checking hardcoded capability strings. Ensures correct permission checks for all post types.