ci(qa): add least-privilege permissions block (contents: read)

Silences CodeQL actions/missing-workflow-permissions. The QA gate only reads
the tree (checkout + host scripts), so an explicit read-only token is correct
and defends in depth even if the repo default token scope changes.

Assisted-by: AI

Author: AndrewDemsDS

.github/workflows/qa.yaml

@@ -9,6 +9,10 @@ on:
   pull_request:
     branches: [main, dev]
 
+# Least privilege: this gate only reads the tree (checkout + host scripts), never writes.
+permissions:
+  contents: read
+
 jobs:
   host-qa:
     runs-on: ubuntu-latest