fix(ci): enforce least-privilege permissions across all GHA workflows

[umarfarook882]

---

Problem

GitHub Actions uses the repository's default token permissions when no permissions block is declared. If the repo default is contents: write, every build and test job silently gets write access to the repository. Additionally, when a job declares any explicit permission, all others drop to none, which can silently break steps like actions/checkout.

---

Changes

Three classes of bug fixed across 10 workflow files:

1. Missing workflow-level permissions block: Added permissions: contents: read as a safe default to build-c, build-go, build-node, build-runtime, build-wheels, warm-caches, e2e-test, lint, and test. Set permissions: {} on config.yml whose only job runs echo.
2. Partial explicit job-level block: lint.yml and test.yml changes jobs declared only pull-requests: read, silently dropping contents to none and breaking actions/checkout and dorny/paths-filter on push events. The test.yml rust job had only id-token: write, also dropping contents to none. Added contents: read to all three.
3. Unused contents: read: e2e-test.yml start-runner and stop-runner declared contents: read but neither job checks out code. Removed, leaving only id-token: write for AWS OIDC.

---

Note: Analysed using LLM model (Claude/DeepSeek) and static analysis tools zizmor. All findings are reviewed manually and applied fix.