ci: tighten Python workflow credential and token permissions (#3644)

## Summary
- Run existing live-API examples only on trusted `main` pushes; preserve
all required pull-request and merge-queue checks.
- Remove unnecessary repository-content access from the upload-only
manual PyPI publishing job while preserving `id-token: write` and
Trusted Publishing.
- Remove unnecessary repository-content access from isolated
Python-version issue automation while preserving `issues: write`.
- Leave CodeQL, release GitHub App permissions, protected publishing
configuration, and fully pinned Actions unchanged.

## Verification
- Validated all six workflow YAML documents against the GitHub Actions
schema.
- Audited effective permissions for all 17 jobs and verified all 46
external Actions remain pinned to full commit SHAs.
- Verified trusted-main event behavior, unchanged required checks,
separate build/upload permissions, same-run artifact handling, and
unchanged CodeQL/release scopes.
- Confirmed the existing release workflow has successfully published
with the same OIDC-only upload permissions.
- Python support-policy check passed; `git diff --check` passed.

Administrator-managed repository and environment settings are
intentionally unchanged.