fix(ci): add explicit permissions block to CI workflow

Restricts GITHUB_TOKEN to contents:read (least privilege for a
checkout+lint+test workflow), resolving CodeQL code-scanning alert #2
(actions/missing-workflow-permissions / CWE-275).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gzileni

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Lint & Test