ci: declare explicit GitHub token permissions

[devkoriel]

Summary

• add explicit least-privilege GITHUB_TOKEN permissions before the org default is switched to read-only
• keep write scopes limited to workflows that currently rely on default-token writes

Permission changes

• .github/workflows/docker.yml: contents: read, packages: write (workflow pushes production Docker images to GHCR with GITHUB_TOKEN)

Verification

• generated from the refreshed RFC-043 GitHub Actions token write-permission inventory
• intended to preserve behavior after org-level default token permissions become read-only