fix: tag-triggered releases (release.yml/release-unix.yml) couldn't

actually publish — missing contents: write permission

Confirmed via the first real test of these workflows this session
(tag 2026.07.23-3b7388c): build-macos.sh itself succeeded, but the
softprops/action-gh-release step failed with a 403:
"Resource not accessible by integration". This repo's default GitHub
Actions workflow token permission is "read"
(gh api repos/4cecoder/metanoia/actions/permissions/workflow), and neither
of these two files ever declared their own `permissions: contents: write`
override — unlike release-latest.yml (added this session), which has
always had it and has been publishing successfully.

Added `permissions: contents: write` to every job in both files that
creates a release: release-unix.yml's build-macos/build-linux/
build-android, and release.yml's build. This means the tag-based release
flow may never have actually been able to auto-publish via CI before now,
independent of anything else changed this session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: github-actions[bot]

.github/workflows/release-unix.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   build-macos:
     runs-on: macos-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
 
@@ -52,6 +54,8 @@ jobs:
 
   build-linux:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
 
@@ -97,6 +101,8 @@ jobs:
 
   build-android:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/release.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   build:
     runs-on: windows-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4