Add explicit least-privilege permissions to read-only CI workflows

Seven workflows currently declare no permissions block at all, which leaves
GITHUB_TOKEN scope dependent on the repository default. Adding an explicit
workflow-level contents: read documents the minimum scope needed and matches
GitHub's defense-in-depth guidance.

Workflows touched (all are pure CI - build, lint, docs, tests, spell check,
version consistency check). None push commits, create releases, or call
write APIs:
  - build.yaml
  - code-formatting-check.yaml
  - docs.yaml
  - local-development-makefile.yaml
  - test.yaml
  - typos.yaml
  - version-checks.yaml

Existing workflows that need elevated scopes (cargo-audit, codeql,
github-dependency-review, lint) already declare per-job permissions; this PR
does not modify those.

Author: arpitjain099

.github/workflows/build.yaml

@@ -9,6 +9,9 @@ on:
   schedule: # Trigger a job on default branch at 4AM PST everyday
     - cron: 0 11 * * *
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/code-formatting-check.yaml

@@ -9,6 +9,9 @@ on:
   schedule: # Trigger a job on default branch at 4AM PST everyday
     - cron: 0 11 * * *
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/docs.yaml

@@ -9,6 +9,9 @@ on:
   schedule: # Trigger a job on default branch at 4AM PST everyday
     - cron: 0 11 * * *
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/local-development-makefile.yaml

@@ -9,6 +9,9 @@ on:
   schedule: # Trigger a job on default branch at 4AM PST everyday
     - cron: 0 11 * * *
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/test.yaml

@@ -9,6 +9,9 @@ on:
 
 name: Test
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/typos.yaml

@@ -9,6 +9,9 @@ on:
 
 name: Typos
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/version-checks.yaml

@@ -7,6 +7,9 @@ on:
   pull_request:
   merge_group:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.compare || github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}