ci: add safe production candidate flow

[jomeswang]

Summary

• expose the reusable release workflow's safe production-candidate inputs
• grant read-only Actions access for candidate artifact retrieval
• prevent release tags during prepare_only runs
• pin @tutti-os/app-release-tools@0.0.412

Validation

• git diff --check — passed
• manually reviewed the caller input names, types, permissions, and create_release_tag guard
• no package build was run because this change only updates the production caller workflow; GitHub's reusable-workflow contract check is the authoritative CI gate

Dependency / rollout

This caller requires the matching candidate inputs to be available in tutti-os/tutti/.github/workflows/publish-tutti-app-release.yml@main before merge or execution.

Risk

Production publishing remains unchanged when all new inputs keep their defaults. prepare_only cannot create a release tag. Candidate publication is constrained by the run ID, version, artifact SHA-256, and Git SHA supplied to the reusable workflow.

AI assistance

Prepared with Codex assistance. The final workflow diff and input forwarding were manually reviewed.