merge.yml declares permissions: contents: write (for its README scorecard
commit). A reusable workflow can only use permissions the caller grants, so the
publish workflow's merge-spill job must grant it too -- otherwise the
workflow_call fails validation at startup (v0.3.9's first tag push did exactly
that, 0s startup_failure). The commit step is still skipped on tag releases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>