Deleting a live post now needs the publish permission

An automated key allowed only to draft and edit could still permanently remove an already-published post. Taking something down — whether by unpublishing or deleting — now consistently requires the separate publish permission, and a key without it gets the same answer whether the post exists or not.