Restrict GITHUB_TOKEN permissions for build-assets job

[Copilot]

The build-assets job had no explicit permissions block, granting it the default (potentially write) GITHUB_TOKEN scopes — more than needed.

Changes

• .github/workflows/release.yml: Added permissions: contents: read to the build-assets job. actions/checkout only needs read access; actions/upload-artifact uses the internal ACTIONS_RUNTIME_TOKEN and requires no repository scopes at all. The create-release job retains contents: write for release asset uploads.

  build-assets:
    runs-on: ubuntu-latest
    permissions:
      contents: read   # added
    strategy:

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.