Follow-ups from #907: old-bash refusal in CI, publication source-ref gate, dry-run packages permission #915

Follow-ups from the review of #907 (non-blocking), tracked here as one issue:

1. The old-bash refusal test never runs in CI. docker-publish-index.sh refuses bash older than 4.4, and test/docker-publish-index.test.ts checks that refusal only where the system bash is older than 4.4. CI runs bash 5 on ubuntu, so deleting the guard would leave CI green. The fix runs that test somewhere with bash 3.2 (the macOS leg that already runs the promote-latest fixtures, or a pinned bash 3.2 binary in the job).
2. Docker publication is not gated on the source ref. A publish=true dispatch from a non-release ref is not refused by the workflow itself. The fix refuses publication unless the ref is a release tag (or main, if that is intended) and says which.
3. Dry runs hold packages: write. A publish=false run cannot push, but the job still has the write permission. The fix scopes packages: write to the publishing job or condition, and the workflow-permissions test pins it.
4. The old-bash test title names exit 1 and the absent destination tag but not the refusal message it also asserts; make the title complete when that file is next touched.

Refs #353, #907.