cimas-master: add least-privilege permissions: to 6 caller templates

[andrew2net]

What

Adds an explicit least-privilege top-level permissions: block to the six cimas master caller templates (cimas-config/gh-actions/master/) that previously had none. These templates sync to downstream standalone gem repos, so a missing permissions: meant each synced repo inherited the over-broad default GITHUB_TOKEN and got flagged by CodeQL actions/missing-workflow-permissions.

Each ceiling is sized to what the called reusable workflow actually needs (the caller's top-level permissions: caps the reusable's GITHUB_TOKEN):

Template	Permissions	Why
release.yml, release_wo_bundle_install.yml	contents: write + id-token: write	rubygems-release.yml release job: git tag push + OIDC Trusted Publishing
release_github_packages.yml	contents: write + packages: write	ghpkg-release.yml: tag push via GITHUB_TOKEN; gem push uses pat_token
notify.yml	contents: read	mn-processor-notify.yml: dispatch via pat_token only
rake-flavor.yml	contents: read	mn-processor-rake.yml already tops at contents: read
automerge.yml	contents: write + pull-requests: write	pascalgn/automerge-action merges PRs via GITHUB_TOKEN

master/rake.yml already carried contents: write and is unchanged. Also fixes a pre-existing missing-EOF-newline in release_github_packages.yml.

Context / scope note

This originated from a metanorma/pubid hand-off asking to fix the "source templates" behind pubid's generic-rake.yml / rubygems-release.yml. During investigation:

• metanorma/ci's own reusable generic-rake.yml and rubygems-release.yml already carry least-privilege permissions — no change needed there.
• pubid is not currently cimas-synced (cimas.yml lists it PENDING-READD, gated on cimas revival: design gaps and mandatory drift-audit before each sync #300 Gap 2), and its workflows are pubid-local + diverged — so no metanorma/ci change reaches pubid today.
• The genuine upstream gap was these master caller templates, which this PR closes for every downstream standalone repo on its next sync.

pubid's own 5 alerts are addressed separately by hardening pubid's local workflows directly (safe while sync is paused) — tracked out-of-band, not part of this PR.

Validation

Repo CI is yamllint + actionlint + shellcheck (no rspec). Locally verified: all 6 files parse as valid YAML with the intended scopes; no trailing whitespace, lines ≤140, files end with a newline; only the 6 templates changed. yamllint/actionlint run in CI on push.

[opoudjis]

Ack — this is well-scoped and reads cleanly. Deliberately keeping it out of the wave I'm firing tonight (which carries a release.yml template fix from Koonwa's lutaml#285 discovery, the rubocop template correction from 2026-07-07, and a broader-orphan cleanup) so it can carry Ronald's review on its own merits. Will fold into the next wave once merged.

🤖

[opoudjis]

@ronaldtse — flagging that this is now blocking the CodeQL missing-permissions: finding class from being retired across the fleet. Tonight's cimas sync wave opened 83 PRs, and CodeQL is re-surfacing the same "workflow does not contain permissions" finding on release.yml (and related) on each affected gem — e.g. coradoc#248 (review 4646568938) is the representative case.

Your approval on this PR unblocks the fix — the six template permissions: blocks fold into the next cimas sync wave and retire the finding fleet-wide. Review lives on this PR directly (Files changed tab has the six diffs with per-template ceilings and rationale).

🤖