What Problem This Solves

Full Release Validation run https://github.com/openclaw/openclaw/actions/runs/29617653209 correctly executed from the canonical extended-stable/2026.6.33 branch, but GitHub rejected two child workflows before any jobs ran:

• Plugin Prerelease 29617672669: nested push_docker_e2e_images and push_live_test_image requested packages: write through a read-only caller.
• Release Checks 29617674873: nested Install Smoke push_root_dockerfile_image requested packages: write through a read-only caller.

After resolving the startup errors, focused PR-head probing also showed the frozen Release Checks trust guard omitted the canonical extended-stable/YYYY.M.33 workflow branch.

This restores the complete canonical-branch startup contract without granting publication permissions.

Why This Change Was Made

Upstream PR #103834 / b597a8d364f2849c704b2d0087a9c6c087def2f7 fixed the permission contract by separating image publication from no-write validation. The v6.11 candidate carried the preceding no-write work but missed that follow-up. Upstream PR #99352 / c7810fc6972c0152cb5b5c473011bb8d8aefee0b added the canonical extended-stable Release Checks allowance; the candidate carried the surrounding publisher work but omitted those guard lines.

This is the narrow 6.x adaptation:

• remove the three validation-owned image publisher jobs;
• default shared/root images to immutable artifact transport;
• retain read-only reuse of existing registry images;
• remove validation-time packages: write permissions;
• authorize only the canonical extended-stable/YYYY.M.33 Release Checks ref shape;
• update focused workflow contract tests.

The broad upstream installer refactor and separate Docker publisher workflows are intentionally omitted. Extended-stable 2026.6.33 is npm-only and must not publish Docker images.

User Impact

No OpenClaw runtime or package contents change. This only allows the frozen candidate's own release workflows to start with least-privilege permissions.

Release scope remains v2026.6.33, npm extended-stable, core openclaw plus the canonical all-publishable official plugin inventory at exact version 2026.6.33. GitHub Releases, native apps, Docker images, ClawHub, mobile, and website publication remain excluded. No tag or publication has occurred.

Security impact is positive: validation no longer contains nested jobs capable of obtaining packages: write; the added branch allowance is exact and month-bounded. Rollback is a revert, which would restore the deterministic startup/trust failures.

Evidence

• Reproduction: https://github.com/openclaw/openclaw/actions/runs/29617653209
• Plugin startup failure: https://github.com/openclaw/openclaw/actions/runs/29617672669
• Release Checks startup failure: https://github.com/openclaw/openclaw/actions/runs/29617674873
• PR-head Plugin Prerelease startup proof: https://github.com/openclaw/openclaw/actions/runs/29618103082 (real jobs scheduled; no startup failure)
• PR-head Release Checks parser proof: https://github.com/openclaw/openclaw/actions/runs/29618103282 (workflow parsed; expectedly rejected the noncanonical dev/* workflow ref before the canonical-branch allowance can be exercised)
• actionlint on all touched/calling workflows: pass
• node scripts/run-vitest.mjs test/scripts/install-smoke-no-push-workflow.test.ts test/scripts/release-no-push-workflow.test.ts test/scripts/package-acceptance-workflow.test.ts test/scripts/plugin-prerelease-test-plan.test.ts test/scripts/release-workflow-matrix-plan.test.ts: 83/83 pass
• oxfmt --check on changed tests: pass
• git diff --check: pass

After merge, npm preflight and Full Release Validation will be rerun from the canonical branch at its new exact head. Historical runs will not be reused.