chore(ci): declare explicit GITHUB_TOKEN permissions on unscoped jobs

[jfrench9]

Summary

Closes the three open actions/missing-workflow-permissions code scanning alerts by adding an explicit permissions block to each job that lacked one.

Worth being clear about the severity: the org and repo already set default_workflow_permissions: read, so the token in these jobs is already read-only at runtime. CodeQL is flagging the absence of a declaration, not an actual over-grant. The value here is that the workflows stop depending on an org setting someone could flip later, and the intent becomes self-documenting.

Changes

Job	Scope	Why
test.yml → test	contents: read	Only checks out the repo
create-release.yml → create-release	contents: write	Pushes the version commit to main and creates the release branch
create-release.yml → create-summary	{}	Only writes to $GITHUB_STEP_SUMMARY

Two things worth a reviewer's attention

CodeQL's suggested fix for create-release is wrong. It recommends contents: read, but that job pushes a version commit to main and creates the release branch. It checks out with ${{ secrets.ACTIONS_TOKEN || github.token }} — read would break the fallback path. write both satisfies the alert and repairs a latent break, since that fallback is already dead today under the read-only default.

The test job change is the one that carries real weight. It runs npm install, which executes arbitrary postinstall scripts. Fork PRs already get a read-only token on a public repo, but pushes to main don't — so pinning that job explicitly is genuine defense-in-depth against a compromised transitive dependency.

Verification

• Pre-commit gate green: format:check, lint, test (22 passed).
• Both files re-parsed cleanly by Prettier's YAML parser.
• No runtime/package changes — CI config only.