The admit job used the workflow read token. gh release view answers "release not found" for a draft that exists when the token cannot read drafts. Give that job contents: write. The other jobs keep their own permissions, and the workflow default stays read.