ci: Add missing top-level permissions to publish-release workflow

[Mrtenz]

Summary

• Adds top-level permissions: contents: read to publish-release.yml, restricting default token permissions for all jobs in the workflow.

---

Note

Low Risk
CI-only least-privilege change; jobs that need write or OIDC permissions still declare them explicitly.

Overview
Adds workflow-level permissions: contents: read to .github/workflows/publish-release.yml so the default GITHUB_TOKEN scope is read-only for every job in this reusable release workflow.

Jobs that still need broader access keep their existing job-level overrides (for example contents: write on release/docs jobs and id-token: write on publish-npm), so release behavior should stay the same while tightening the baseline token permissions.

^{Reviewed by Cursor Bugbot for commit 6b92d0c. Bugbot is set up for automated code reviews on this repo. Configure here.}