test(promotion): cover global download after approval

[XiaoSeS]

Problem

Issue #763 reports that a Skill promoted from a team namespace to global is visible but its download button is disabled.

Investigation

The report was exercised against the exact official v0.2.18 images with real authentication and local object storage:

• published source versions 1.0.0 and 2.0.0
• explicitly promoted the non-latest 1.0.0 version
• verified a regular user receives 403 when attempting approval
• approved as an administrator
• verified the global version is PUBLISHED with downloadAvailable=true
• downloaded anonymously and confirmed the archive contains the 1.0.0 source content
• verified the web download button is enabled and downloads successfully

The reported failure was not reproducible in this configuration, so this PR does not add a speculative production-code change.

Scope

• bring the existing promotion smoke setup in line with current namespace permissions and response shapes
• wait for asynchronous scan/publication readiness
• remove the external zip command dependency by using Python stdlib
• exercise approval authorization and the full promoted download path
• inspect the downloaded SKILL.md

Validation

• bash -n scripts/promotion-smoke-test.sh
• promotion smoke test: 17 passed, 0 failed
• official v0.2.18 runtime cases: 8 passed, 0 failed
• Chromium desktop download-button and archive validation passed

Refs #763