fix: add explicit permissions to build job workflow

[Copilot]

The build job in build.yml had no explicit permissions block, leaving it subject to whatever repository-default GITHUB_TOKEN permissions were configured — violating least-privilege (CodeQL actions/missing-workflow-permissions, alert #1).

Changes

• .github/workflows/build.yml: Added permissions: contents: read to the build job — the minimum required for actions/checkout. The publish job already had its own explicit permissions and is unchanged.

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read