ci(skills): set least-privilege workflow permissions

Add top-level contents: read permissions to main and lint-build-test workflows so GITHUB_TOKEN is least-privilege. Clears CodeQL 'workflow does not contain permissions' alerts; job-level blocks (security-events: write, contents: write) still override where needed.

Author: abretonc7s

.github/workflows/lint-build-test.yml

@@ -3,6 +3,9 @@ name: Lint, Build, and Test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   validate-changelog:
     name: Validate changelog

.github/workflows/main.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }}
   cancel-in-progress: ${{ !contains(github.ref, 'refs/heads/main') }}
 
+permissions:
+  contents: read
+
 jobs:
   check-workflows:
     name: Check workflows