Tighten workflow permissions to least-privilege (#656)

Parent: bfbc34d

Committed by GitHub <noreply@github.com> on 6/3/2026, 9:09:52 AM