Initial test

Grant contents: read to the release workflow

A permissions block replaces the default permission set rather than
extending it, so id-token: write alone left actions/checkout without read
access and the checkout failed with "repository not found" on this
private repository.