ci: restrict GITHUB_TOKEN to least-privilege (contents: read)

Resolves three CodeQL actions/missing-workflow-permissions alerts.
No CI job needs write access.

Author: max3925vats

.github/workflows/ci.yml

@@ -8,6 +8,10 @@ on:
     branches:
       - main
 
+# Least-privilege: CI only reads the repo; no job pushes commits, releases, or comments.
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest