Restrict candidate workflow token permissions

[bob-codedaptive]

Motivation

• The candidate CI granted contents: write at workflow scope so every job got a write-capable GITHUB_TOKEN, allowing checked-out candidate code or build dependencies to modify repo refs or releases before the gated publish step.
• Reduce the repository token blast radius by giving build/test jobs only read access and only allowing write access for the single job that publishes/prunes the prerelease.

Description

• Change the workflow default permission from contents: write to contents: read in .github/workflows/candidate.yml so jobs do not inherit write capability by default.
• Add persist-credentials: false to every actions/checkout invocation in the candidate workflow to prevent checked-out code from reusing the checkout-provided token.
• Grant contents: write specifically to the prerelease job so only the publish/prune step has write rights.
• Commit message: ci: restrict candidate workflow token permissions (updated file: .github/workflows/candidate.yml).

Testing

• Ran a lightweight YAML sanity check with ruby -e 'require "yaml"; p YAML.load_file(".github/workflows/candidate.yml").keys', which succeeded.
• Ran static validation via a Python script that checks for contents: read at the workflow level, persist-credentials: false on each checkout, and contents: write on the prerelease job, which passed using line-based checks (no PyYAML available in the environment).
• Ran git diff --check to ensure no whitespace or diff issues, which passed.

---

Codex Task

[github-actions]

Thank you for your contribution to MOOTx01. Before it can be merged we need you to sign our Contributor License Agreement. You can read it here: CLA.md. To sign, post a comment on this pull request with exactly the following text:

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}