Summary
- restore production release-tag deploy config reads by falling back to
PRODUCTION_ENV_READ_TOKENonly after the default workflow token gets a 403 on Actions environment variables - keep build-only tag behavior unchanged when production-scoped variables are unset
- document the fallback secret contract and lock the behavior with workflow regression coverage
Verification
- main push workflows for
eae3e4abdc76514f05e3d8496154a3e5ad233cf9completed successfully Nightly Testscompleted successfully on current mainNightly Full Testscompleted successfully on current main