Apply least-privilege GITHUB_TOKEN permissions per job

[piers-sinclair]

Problem

release.yml declares permissions: contents: write at the workflow level, so every job inherits write. Other workflows rely on default token permissions rather than declaring minimal scopes.

Fix

• Set a top-level permissions: contents: read and grant contents: write only on the job that creates the GitHub Release.
• Audit each workflow and declare the minimum scopes it needs.

Priority: Low