Phase 3 · separate release authority

Canonical release control.

Use the dedicated release-authority credential. The operations token is deliberately rejected here, and this credential is never written to browser storage.