ci: scope GITHUB_TOKEN to least privilege (#9)

Repo default is write (gh api repos/.../actions/permissions/workflow ->
default_workflow_permissions: write), so every job here ran with a
write-capable token even though this workflow now runs on every PR,
including from forks, and only the release-asset upload step actually
needs write access. Top-level contents: read, overridden to
contents: write on the one job whose release step needs it.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: jamesarich

.github/workflows/githubci.yml

@@ -8,6 +8,15 @@ on:
     types:
       - created
 
+# The repo's default is write (checked via `gh api .../actions/permissions/workflow`),
+# so every job here would otherwise get a write-capable GITHUB_TOKEN even
+# though only the release-asset upload needs one — and this workflow now
+# runs on every PR, including from forks. contents:write is scoped to the
+# one job that needs it (the release step, gated separately by
+# `if: github.event_name == 'release'`); everything else gets read-only.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -32,6 +41,10 @@ jobs:
   build:
     needs: set-matrix
     runs-on: ubuntu-latest
+    # Only this job's release step needs write access (softprops/action-gh-release
+    # creating/updating release assets); PR runs never reach that step.
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix: