ci(hooks-check): add explicit permissions block + workflow-self path filter on PR (Copilot/CodeQL review)

Author: Jon Langevin

.github/workflows/hooks-check.yml

@@ -11,6 +11,11 @@ on:
       - 'hooks/**'
       - 'tests/hook-contracts.sh'
       - 'tests/hook-stdout-discipline.sh'
+      - '.github/workflows/hooks-check.yml'
+
+permissions:
+  contents: read
+
 jobs:
   hooks:
     runs-on: ubuntu-latest