ci(release): respect protected master during beta publication

[kattsushi]

Problem

Beta run 33125785457 passed release detection, build, tests, React Router readiness, and npm authentication, then failed before publication because Nx created a local release commit/tags and attempted an atomic push directly to protected master. GitHub rejected the push with GH006 because master requires pull requests.

The rejection was atomic: no release commit, beta tags, GitHub Releases, or npm packages were published.

Approved scope

Implementation is limited to:

• .github/workflows/cd.yml
• scripts/release-policy-contract.test.mjs
• .github/SETUP.md

The PR also preserves the authoritative compact OpenSpec artifacts under openspec/changes/protect-branch-release-orchestration/. The complete PR must remain at or below 1,200 additions plus deletions and must not add dependencies, modules, coordinators, schemas, or GitHub Apps.

Required behavior

• PREPARE materializes beta versions with all Nx Git side effects disabled, validates only the selected manifests plus root CHANGELOG.md, and pushes only release/beta-<source-sha>.
• A maintainer manually creates and approves the linked release issue and opens the release PR with type:chore as its sole type:* label.
• A structurally valid merged release PR is suppressed rather than recursively preparing another release; suspicious release-shaped changes fail closed.
• Manual FINALIZE requires explicit projects and the exact current protected master SHA, reconciles exact annotated tags and GitHub prereleases, then reuses nx release publish --tag=beta for only missing packages.
• Unknown or conflicting GitHub/npm state fails closed; exact retries are idempotent.

Acceptance criteria

• Parsed workflow contracts cover PREPARE, suppression, FINALIZE, static dead code/heredocs, active failure exits, exact tag refspecs, Release ordering, and npm retry/conflict behavior.
• The contract suite, YAML parsing, affected lint, repository formatting, and diff checks pass.
• Alpha and stable workflows remain unchanged; stable is not dispatched.
• The implementation phase performs no workflow dispatch, release version command, remote push, tag, GitHub Release, or npm publication.
• The complete issue-linked implementation PR contains one reviewable work unit and stays within 1,200 changed lines.

Non-goals

• Relaxing or bypassing master branch protection.
• Building a generic release coordinator or attestation platform.
• Migrating alpha or stable orchestration.
• Publishing beta from a local machine.