ci: narrow workflow permissions

[omkhar]

Summary

• remove the explicit zizmor excessive-permissions ignores by tightening CI and Security to workflow-level permissions: {} with per-job minima
• narrow the rest of the workflow fleet away from redundant top-level permissions: read-all
• keep explicit higher-scope jobs only where they are still required, including release preflight actions: read for zizmor-action

Local validation

• ./scripts/check-workflows.sh
• actionlint .github/workflows/*.yml
• zizmor .github/workflows

Peer review

• permissions-focused review found one real regression in release.yml (zizmor-action still needed actions: read in private-repo preflight); fixed in follow-up commit
• final reviewed worktree returned no findings and is merge-ready pending PR CI