Fix release record preflight

[ranade-oss]

What changed

• Removed the unreliable repository-level permissions.push assertion from the production release-record preflight.
• Retained the annotated temporary tag and git push --dry-run as the actual write-capability test.
• Added an EXIT trap so the temporary local preflight tag is deleted whether the dry run succeeds or fails.

Why

Release-train run 30390248001 completed qualification, image build, rehearsal, rollback verification, candidate staging promotion, and legal-source checks, then failed before production because gh api repos/... --jq '.permissions.push' returned a value other than true even though the job token had contents: write.

Impact

The release train will now gate production on the real tag-push dry run instead of an unreliable metadata field. No production application behavior is changed by this PR.

Validation

• Change is limited to .github/workflows/verify-and-deploy-public-beta.yml.
• Existing contents: write job permission remains unchanged.
• The preflight still fails before production if a tag collision exists or the dry-run tag push is rejected.