Restrict workflow permissions to contents: read

All CI jobs and the deploy workflow only need to read repo contents.
Adding explicit top-level permissions satisfies zizmor's
excessive-permissions audit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -3,6 +3,9 @@ name: Deploy
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest