Document OSS permission posture

[Will-thom]

Summary

• Document the repository permission posture for public OSS stabilization.
• Record that public mode keeps branch protection available without a paid plan.
• Reduce release workflow default token scope to read-only, with write access only on the publish job.

Validation

• go test ./... with repository-local GOCACHE
• GitHub API audit confirmed public visibility and main branch protection with All CI checks.

[github-actions]

Hi @Will-thom, thank you for contributing to PR Maven CLI.

I appreciate the time you spent opening this pull request. This project is intentionally shaped for focused, reviewable open source contributions, so your input helps the tool become more useful for Java and Maven teams.

A maintainer will review the context, labels, and next steps as soon as possible. If this is your first contribution here, welcome aboard.

Useful links:

• Contributing guide: CONTRIBUTING.md
• Testing guide: docs/testing.md
• CI/CD guide: docs/ci.md

Thank you for helping build a deterministic, local-first Maven failure triage tool.