chore(ci): declare explicit GITHUB_TOKEN permissions on unscoped jobs

.github/workflows/create-release.yml

@@ -16,6 +16,12 @@ on:
 jobs:
   create-release:
     runs-on: ubuntu-latest
+
+    # Pushes the version commit to main and creates the release branch. Needed
+    # for the `|| github.token` fallback when ACTIONS_TOKEN is unset.
+    permissions:
+      contents: write
+
     outputs:
       new_version: ${{ steps.new-version.outputs.new_version }}
       branch_name: ${{ steps.new-version.outputs.branch_name }}
@@ -130,6 +136,9 @@ jobs:
     needs: [create-release, create-tag]
     if: always()
     runs-on: ubuntu-latest
+
+    # Only writes to $GITHUB_STEP_SUMMARY; needs no token scopes at all.
+    permissions: {}
     steps:
       - name: Create summary
         run: |

.github/workflows/test.yml

@@ -12,6 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
+    # Only reads the repo; npm install runs arbitrary postinstall scripts, so
+    # keep the token scoped down regardless of the org-wide default.
+    permissions:
+      contents: read
+
     # 22 is the oldest Node still in support; 24 is the LTS the consuming
     # apps now run on. Testing only the newest would leave consumers on 22
     # unverified. Node 18 is omitted despite engines.node — it went EOL in