Add explicit permissions blocks to GitHub Actions workflows

Apply least-privilege principle by declaring only the permissions each
workflow actually needs, instead of relying on the broad default
GITHUB_TOKEN scope.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>