chore(CI): add least-privilege permissions to GitHub Actions workflows (#322)

## Summary
- Add explicit least-privilege `permissions` blocks to workflow files
flagged by CodeQL.
- Scopes derived from workflow operations (build, artifacts, Danger,
release git push).
- Resolves **5** open `actions/missing-workflow-permissions` alerts.

## Linear
- Parent: [APPSEC-164](https://linear.app/stream/issue/APPSEC-164)

## Test plan
- [ ] CI green
- [ ] Code scanning alerts close after merge