ci: Add missing top-level permissions to publish-release workflow

[Mrtenz]

Summary

• Adds top-level permissions: contents: read to the publish-release workflow, following the principle of least privilege.

---

Note

Low Risk
Workflow-only permission tightening with no application or release logic changes; job overrides preserve existing publish behavior.

Overview
Adds workflow-level permissions: contents: read to publish-release.yml so the reusable workflow defaults to least privilege instead of relying on the repository default token scope.

Job-level overrides are unchanged: publish-release still requests contents: write, and publish-npm still sets contents: read plus id-token: write for OIDC publishing.

^{Reviewed by Cursor Bugbot for commit 1743f09. Bugbot is set up for automated code reviews on this repo. Configure here.}