fix(ci): repair release-checks caller permission

[forkwright]

Change

Grant only checks: read to the release-checks caller, matching the shared reusable workflow's declared permission. Also correct one API doc sentence left over from the former implicit HIP fallback: NoGpuBuild now means an explicit CPU-only build.

Evidence

The shared reusable added checks: read in forkwright/.github PR #70, revision 5556cb9. The caller's permission cap can only reduce the callee's permissions. Logismos did not include that read scope, so run 33993648179 failed at startup with zero jobs. This predates foundation PR #151: the caller was unchanged from 7a24c6d to a0f4250, and run 33990070268 already had the same failure. Last successful checks used reusable d1a82c9; failures began when it resolved 5556cb9 on September 3.

Validation and limits

Static YAML parse and git diff --check passed. Normal PR CI checks the integrated tree. No trigger, secret, credential, GPU/device permission, or service configuration changes; this grants read access to check runs only. Post-merge workflow startup will establish the permission repair.

[forkwright]

Post-merge verification: run https://github.com/forkwright/logismos/actions/runs/33994213613/job/101381698351 now starts, passes the shared helper's self-tests and successfully approves three held runs. This establishes that the caller permission repair works. The helper then made an immediate empty-rollup observation; checks appeared seconds later. That distinct shared-reusable timing defect is tracked at forkwright/.github#71 and does not justify broader permissions. The release PR's remaining GPU-denied check failure is a stale workspace Cargo.lock after its version bump, not a boundary regression. Release PR #152 has not been edited or merged by this lane.