All CI jobs and the deploy workflow only need to read repo contents.
Adding explicit top-level permissions satisfies zizmor's
excessive-permissions audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bare pip install fails on newer Ubuntu runners due to PEP 668
(externally-managed-environment). Use pipx which is pre-installed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The download URL was missing the version number in the asset filename.
Use the official download script which handles version resolution.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>