Fix TokenPermissionsID: apply least-privilege permissions

Apply principle of least privilege for GITHUB_TOKEN:
- Change top-level permissions to read-only
- Jobs inherit read permissions, can escalate as needed

This resolves Scorecard TokenPermissionsID alerts.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: mistral-vibe

.github/workflows/release.yml

@@ -25,7 +25,7 @@ on:
     tags:
       - 'v*'
 permissions:
-  contents: write
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true