Fix TokenPermissionsID: apply least-privilege permissions

[hyperpolymath]

Apply principle of least privilege for GITHUB_TOKEN:

• Change top-level permissions to read-only
• Jobs inherit read permissions, can escalate as needed

This resolves Scorecard TokenPermissionsID alerts.

Generated by Mistral Vibe.

Summary

Closes #

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (would change existing behaviour)
• 🕳️ Soundness fix (fixes a checker/proof false-negative)
• 📖 Documentation
• 🧹 Refactor / tech debt (behaviour-preserving)
• ⚡ Performance
• 🔧 Build / CI / tooling

How has this been verified?

Checklist

• My commits are signed (git commit -S).
• I ran the project's own checks/tests locally and they pass.
• New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
  prose CC-BY-SA-4.0); I did not relicense existing files.
• Docs are updated, and no public claim now overstates what the code does.
• I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: db286d01-d5ed-40bf-9332-d08c1351cce2

📥 Commits

Reviewing files that changed from the base of the PR and between 79d0dca and d48fe79.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

 _____________________________
< ░R░e░v░i░e░w░ ░i░n░ ░b░i░o░ >
 -----------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}