Release gate: the packages' dry run is unsigned and skips the release job

The gate passes no secrets to release.yml, so the macOS and Windows signing steps skip as
they do on a fork (no signing secret, no SignPath quota), and the new packages_only input
skips the release job (checksums, update signing, publishing). The call still grants
contents: write, which GitHub checks for the skipped job before the run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release-gate.yml

@@ -7,8 +7,10 @@
 #   determinism check, the property tests, the repository checks (web-offline among them),
 #   WebAssembly and RISC-V, Windows D3D12 FXC and Windows app startup;
 # - kernel-rig.yml: every rig area against its KNOWN_FAILING and the ladder against its golden;
-# - release.yml as a dry run (draft false): the Linux, Flatpak, Snap, FreeBSD, macOS, Windows and
-#   web packages with their smoke tests and package checks.
+# - release.yml as a dry run (draft false, packages_only): the Linux, Flatpak, Snap, FreeBSD,
+#   macOS, Windows and web packages with their smoke tests and package checks, unsigned (no
+#   secrets are passed, so no signing secret or SignPath quota is used) and without the release
+#   job (checksums, update signing, publishing).
 # The gate passes only when all three pass. Before main is replaced, tag the old main
 # (main-before-develop-<date>) and push the tag.
 name: Release gate
@@ -43,14 +45,16 @@ jobs:
   packages:
     name: Packages
     uses: ./.github/workflows/release.yml
-    # release.yml's last job asks for contents: write (it creates releases); a dry run only keeps
-    # the files as an artifact.
+    # No secrets: the signing steps skip without them. GitHub checks a called workflow's job
+    # permissions before the run, skipped jobs included, so the release job's contents: write must
+    # be granted here; packages_only skips that job, and no step that runs writes to the
+    # repository. actions: read is the Windows job's.
     permissions:
       contents: write
       actions: read
-    secrets: inherit
     with:
       draft: false
+      packages_only: true
 
   release-gate:
     name: release-gate

.github/workflows/release.yml

@@ -20,7 +20,8 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
-# The release gate (release-gate.yml) calls it as such a dry run.
+# The release gate (release-gate.yml) calls it as such a dry run, without secrets (unsigned) and
+# without the release job (packages_only).
 # A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
 #   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release
@@ -43,8 +44,15 @@ on:
         default: ""
   # The release gate (release-gate.yml): a dry run (draft false) of every package and its checks.
   # The event stays the caller's (workflow_dispatch), so a call runs as a dispatched dry run does.
+  # The gate passes no secrets, so nothing is signed (the signing steps skip without their
+  # secrets, as on a fork), and packages_only skips the release job (checksums, update signing,
+  # publishing).
   workflow_call:
     inputs:
+      packages_only:
+        description: "Build and check every package only: no release job"
+        type: boolean
+        default: false
       draft:
         description: "Create/update a draft (release branch only; off: build artifacts only)"
         type: boolean
@@ -600,7 +608,8 @@ jobs:
   release:
     name: GitHub Release or dry-run artifacts
     needs: [version, linux, flatpak, snap, freebsd, macos, windows, web]
-    if: needs.version.outputs.build == 'true'
+    # Not for the release gate (packages_only): it builds and checks the packages, nothing more.
+    if: needs.version.outputs.build == 'true' && !inputs.packages_only
     runs-on: ubuntu-latest
     permissions:
       contents: write