ci: scope contents: write to release job only

[Copilot]

With pull_request trigger enabled, the workflow-level contents: write permission applies to all jobs including compile jobs that run on PRs—unnecessarily broad for code that checks out and builds upstream dependencies.

Changes

• Workflow-level permissions: Downgrade contents: write → contents: read (least-privilege default for all jobs)
• release job: Add explicit permissions: contents: write scoped only to the job that creates tags and uploads release assets

# Before
permissions:
  contents: write   # applied to all jobs

# After
permissions:
  contents: read    # workflow default

jobs:
  release:
    permissions:
      contents: write   # only where needed

[kenvandine]

Safer, thanks