Fix/workflow permissions

[eschaar]

Summary

This PR prepares the 1.0.5 release line with workflow hardening and manifest refresh.

What changed:

• Added explicit GitHub Actions permissions across workflows to satisfy policy checks and enforce least privilege.
• Updated release workflow permissions to default read-only, with write access scoped only to the version-and-release job.
• Normalized verify workflow syntax to use on: style consistent with the other workflows.
• Refreshed the generated vstack install manifest metadata.
• Updated changelog entries so 1.0.4 remains the released set and the latest branch changes are tracked as 1.0.5.

Why:

• Ensure workflow security policy compliance.
• Reduce token permission scope in CI/CD.
• Keep generated metadata and release documentation aligned.

Related Issues

• No linked issue.
• Follow-up from workflow policy warning: Workflow does not contain permissions.

Validation

• Tests pass locally
• CI checks pass
• Docs updated (if needed)

Release Impact

• feat: (minor)
• fix: (patch)
• BREAKING CHANGE (major)
• No release impact

[Copilot]

Pull request overview

This PR hardens GitHub Actions workflows for the 1.0.5 release line by explicitly declaring least-privilege permissions, updating the release workflow to minimize write scope, and refreshing the generated vstack install manifest metadata. It also updates the changelog to track the latest branch work under 1.0.5 while keeping 1.0.4 as the released set.

Changes:

• Added explicit workflow-level permissions to QA, Verify, and Security workflows.
• Updated Release workflow to default to contents: read and grant contents: write only to the tagging/release job.
• Refreshed .github/vstack.json metadata and updated CHANGELOG.md for 1.0.5.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
CHANGELOG.md	Adds 1.0.5 entry describing workflow permission hardening and manifest refresh.
.github/workflows/verify.yml	Normalizes on: syntax and declares read-only workflow permissions.
.github/workflows/security.yml	Declares explicit read permissions needed for PR-context scanning steps.
.github/workflows/release.yml	Makes workflow token read-only by default; scopes write to the release job.
.github/workflows/qa.yml	Declares explicit read-only workflow permissions for CI checks.
.github/vstack.json	Updates generated install manifest timestamp metadata.