Restore checkout access in CI by granting minimal workflow contents: read permission

[Copilot]

The test (3.14) GitHub Actions job failed before tests ran because repository checkout could not authenticate. The workflow-level permissions were set to {}, which removed the token scope required by actions/checkout.

• Root cause

  • Workflow explicitly set permissions: {}, resulting in a token without repository contents read access.

• Change

  • Updated .github/workflows/main.yaml to grant the minimum required scope for checkout:
    • contents: read

• Why this is minimal

  • Preserves least-privilege posture while enabling repository fetch for all matrix jobs.

# .github/workflows/main.yaml
permissions:
  contents: read