Add permissions and path filters to release-on-merge workflow

[Yonghui-Lee]

• Added checks: read and statuses: read permissions to the publish job in release-on-merge.yml to satisfy the nested e2e-tests job in release.yml.
• Added paths: filter (docs/source/changelog.rst) to on.pull_request so standard code/test PRs do not trigger release-on-merge.yml runs.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.68%. Comparing base (1b08827) to head (40cfa2b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #944   +/-   ##
=======================================
  Coverage   89.68%   89.68%           
=======================================
  Files          16       16           
  Lines        3579     3579           
=======================================
  Hits         3210     3210           
  Misses        369      369           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.