fix(ci): require release-revision tests and scope publishing OIDC

[dinakarjs]

Require release-revision tests before TRACE package publication

Both publishers currently build and inspect installed artifacts without depending on the full test matrix. The root publisher also grants OIDC token access at workflow scope.

Make the existing root and conformance CI workflows reusable. Each publisher invokes the relevant matrix and makes its build depend on successful tests. Keep the existing release tag/version and artifact checks. Restrict root id-token: write permission to the publishing job.

Validation: the patch applies to aa5c350 and all four workflow files parse. Dependency-model checks cover successful, failed, cancelled and skipped tests. Removing either new build dependency lets the model reach publishing despite failed tests, demonstrating the intended gate. Static permission checks confirm the root build has no OIDC grant. These checks do not execute Actions or the full suites; actionlint and release-ref execution remain required. Upstream CI, Conformance CI, CodeQL and Workflow lint are awaiting maintainer approval to run; GitHub reports four workflows awaiting approval. The contributor reputation check passed. The separate governance gate requires one independent maintainer approval of head 7acaa5269e673e6150a8b239381a6dc16c570531 and found zero.

Scoped follow-up to agentrust-io/.github#54. Environment restrictions, publisher bindings and operator availability remain unverified. No publishing dispatch or settings change occurred.

Pre-submission independent reading: completed by a fresh agent session with no previous work context. The reader checked the diff, description, validator, baseline and updated workflows, and independently fetched the unchanged conformance package workflow. No blocking bug was found. The reader identified stale pending-review statements; those were updated. This reading does not establish live Actions execution or environment/operator safeguards.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Publishing now waits on the full matrix in both publishers, and id-token: write is scoped to the publish job. Both called workflows request only contents: read, so the call does not widen anything. Marking ready and merging.