Inconsistent explicit permissions: hardening across GitHub Actions workflows

[yakew7]

Where: .github/workflows/*.yml - explicit permissions: blocks.

The gap: codeql.yml declares an explicit permissions: block; favicons.yml, build-explainers.yml, audits.yml, lint.yml, and frozen-files.yml declare none at all, relying on the repo/org's default GITHUB_TOKEN scope instead of the minimal contents: read these check-only jobs actually need.

Repro:

grep -n "permissions:" .github/workflows/*.yml

shows the block present in only one of the six workflow files that don't need write access.

Why it matters: build-explainers.yml's own git history shows a prior permissions: contents: write was deliberately dropped when the job became check-only rather than auto-committing - but nothing was added back in its place, so newer workflows modeled on it (like favicons.yml) inherited the implicit-default pattern rather than the safer explicit contents: read. Not a live vulnerability (none of these jobs currently misuse elevated access), but an inconsistency worth closing before a future copy-paste extends a workflow's permissions by accident.

Suggested fix: add permissions:\n contents: read to each of the read-only check workflows, matching codeql.yml's existing pattern.