try to fix LTS prerelease workflow

It's being skipped, not failing to fire, implying the wrong ref?
This subsumes #10415.

.github/workflows/validate.yml

@@ -21,6 +21,8 @@ on:
       - "release-notes/**"
     branches:
       - master
+      # hardcoded LTS branch, change when new LTS released!
+      - '3.12'
   pull_request:
     paths-ignore:
       - "doc/**"
@@ -478,10 +480,12 @@ jobs:
           files: binaries/cabal-*
 
   prerelease-lts:
-    name: Create a GitHub LTS prerelease with the binary artifacts
+    name: Create a GitHub LTS prerelease with the binary artifacts ${{ github.ref }}
     runs-on: ubuntu-latest
     # The LTS branch is hardcoded for now, update it on a new LTS!
     if: github.ref == 'refs/heads/3.12'
+    permissions:
+      contents: write
 
     # IMPORTANT! Any job added to the workflow should be added here too
     needs: [validate, validate-old-ghcs, build-alpine, dogfooding]