ci: Add top-level permissions to publish-release workflow

[Mrtenz]

Summary

Adds a top-level permissions: contents: read to the publish-release workflow to restrict default token permissions as a security best practice.

---

Note

Low Risk
CI-only permission hardening with no application logic changes; release jobs that need write access still declare it explicitly.

Overview
Adds workflow-level permissions: contents: read to publish-release.yml so reusable runs default to read-only repo access instead of broader implicit GITHUB_TOKEN scopes.

The publish-release job still sets contents: write for release publishing, and publish-npm keeps its existing contents: read / id-token: write block; jobs without overrides (e.g. publish-npm-dry-run) now inherit the tighter default.

^{Reviewed by Cursor Bugbot for commit ffe00f0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ffe00f0. Configure here.}