fix(release): restore id-token permission for cosign keyless signing

Without `id-token: write`, cosign cannot obtain a Sigstore OIDC token
from the GitHub Actions runtime and falls back to an interactive
browser-based OAuth flow, requiring manual link clicks during release.

This permission was commented out alongside the dd-octo-sts work but
is independently required by cosign for keyless signing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: platinummonkey

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 permissions:
   contents: write
-  # id-token: write  # Required by dd-octo-sts — re-enable when org support is added
+  id-token: write  # Required for cosign keyless signing (Sigstore OIDC) and dd-octo-sts
   packages: write
 
 jobs: