ci: add explicit permissions to all GitHub Actions workflows

[mschile]

Summary

• Adds explicit permissions blocks to all 34 workflow files
• Workflows are now self-documenting and independent of the repository-level default GITHUB_TOKEN permission setting

Changes

Workflow(s)	Permissions
main.yml	Top-level contents: read; release job overrides to contents: write (needed for semantic-release and pushing version branches)
29 example-*.yml	contents: read
check-dist.yml, check-markdown.yml	contents: read
add-issue-to-triage-board.yml	permissions: {}
triage_closed_issue_comment.yml	permissions: {}

Why

Previously, none of the workflows declared a permissions block, relying on the repository default (currently "Read and write"). By making permissions explicit in each workflow:

1. Workflows follow the principle of least privilege regardless of the repo setting
2. The repo default can be safely switched to read-only
3. Each workflow is self-documenting about what access it actually needs

Test plan

• Verify all existing CI workflows pass with these changes

---

Note

Low Risk
Mostly declarative GitHub Actions permission scoping; the main risk is mis-scoped GITHUB_TOKEN permissions causing CI/release/triage automation failures.

Overview
Adds explicit permissions blocks across GitHub Actions workflows to enforce least-privilege GITHUB_TOKEN access.

Most CI/example workflows now request only contents: read, triage reusable-workflow triggers explicitly set permissions: {}, and main.yml scopes read-only at the workflow level while granting the release job contents/issues/pull-requests: write for publishing.

^{Reviewed by Cursor Bugbot for commit 7227f7f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b10a2b1. Configure here.}