promote.yml: slsa-build runs where the rung reads the release artifact (unblocks #740); workflow-rules R18

[MattJackson]

Unblocks #740 (predev -> dev, DEV-GREEN). Split out of #755 on purpose: this fix needs no new secret, and #755 waits on one.

Cause. Every #740 run fails the same way: all four hop shards stop at actions/download-artifact with "Artifact not found for name: slsa-artifact-". The dev rung runs the oracle and conformance, so the preflight writes needs_release_artifact=true and each shard waits for slsa-build, then downloads its artifact from its own run. slsa-build is gated to merge_group, so in the pull request into dev it is skipped, and the pinned engine (7ab2191) read the skipped job as green. (busbar-release dev already refuses a skipped job in await-job.)

Fix.

• promote.yml: slsa-build runs on run == '1' && (merge_group || needs_release_artifact == 'true'): the run that judges a promotion builds the release artifact of exactly the commit it promotes. Still contents-read only, still the sha256-pinned engine.
• workflow-rules R18 (RED-armed): a step that downloads slsa-artifact-* from its own run must be reachable only where a job of that run uploads it. R17 is predev's vendor-label rule; this one was renumbered in the merge.

Order. This must land before the engine pin moves past 7ab2191: the newer engine's preflight requires this slsa-build condition (gate.rs BUILDS_WHERE_READ) and refuses a promote.yml without it.

[github-actions]

promote into predev: BOARD @278a0285f: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base 477c11d3d: 0 new red, 0 worse, 5 standing (excused).

tests passed: 24448, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38111695074 . Artifact verdict-278a0285fb7f690a8359c887325276ae0b35fd1f (failures.json, junit.xml, raw.log; 90 days).