Restrict release workflow token permissions

[konard]

Summary

• default the release workflow's GITHUB_TOKEN to read-only repository contents
• preserve explicit contents: write and id-token: write grants only on the automatic and manual publishing jobs
• add a workflow-policy regression test and a Security changelog fragment

Reproduction

Before this change, the workflow had no top-level permissions declaration:

grep -n '^permissions:' .github/workflows/release.yml
# no output

That caused non-publishing jobs to inherit the repository or organization default token scope.

Verification

• pytest tests/test_workflows.py -v
• pytest -v --cov=src --cov-report=term
• ruff check .
• ruff format --check .
• mypy src/
• python scripts/check_file_size.py

Fixes #33

[konard]

Working session summary

Implemented and finalized PR #37.

• Added top-level contents: read permissions.
• Retained write/OIDC permissions only for publishing jobs.
• Added a regression test and Security changelog fragment.
• Removed the generated PR scaffold marker.
• Passed all local lint, type, test, coverage, and packaging checks.
• Final CI passed on SHA 81b90b5.
• PR is clean, mergeable, and ready for review.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $2.284815

📊 Context and tokens usage:

• 76.7K / 200K (38%) input tokens, 6.6K / 128K (5%) output tokens

Total: (76.7K + 1.2M cached) input tokens, 6.6K output tokens, $2.284815 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: off (disabled)
• Model: GPT-5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (1014KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag