fix(ci): scope wiki-sync's contents: write to the job that pushes

Hypatia WH002 flagged the top-level `permissions: contents: write` on
wiki-sync.yml. The top level is now `contents: read`, and the single
`sync` job carries `contents: write`, because scripts/wiki-sync.sh does
push to the wiki with GITHUB_TOKEN. Behaviour is unchanged; the grant is
no longer inherited by any job added later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57

Author: hyperpolymath

.github/workflows/wiki-sync.yml

@@ -12,7 +12,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: wiki-sync
@@ -21,6 +21,9 @@ concurrency:
 jobs:
   sync:
     runs-on: ubuntu-latest
+    # Write is scoped to this job only: scripts/wiki-sync.sh pushes to the wiki.
+    permissions:
+      contents: write
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7.0.1