ci: Add explicit permissions to the sync workflows (#43)

`sync-upstream-rebase.yml` and `sync-promote-branch.yml` are the only
two workflows unique to this repo — every other workflow arrives via
sync from `paradedb/paradedb`, so this is the one place the hardening
has to be applied directly.

Both call reusable workflows in `paradedb/actions@v8`, which declare
job-level permissions:

| Reusable workflow | Declares |
|---|---|
| `reusable-rebase.yml` | `actions: write`, `checks: read`, `contents:
write`, `issues: write`, `pull-requests: read` |
| `reusable-promote.yml` | `actions: write`, `contents: write`, `issues:
write`, `pull-requests: read` |

**A called workflow's permissions are capped by the calling job's
token.** The calling jobs here declare nothing, so today they inherit
the repository default (write) and the reusable workflows get what they
ask for. If the org default is switched to read-only — which grants only
`contents: read` and `packages: read` — the callers would silently cap
the reusable workflows below what they need, and both sync workflows
would break:

- `sync-core.sh` reads check runs via `gh api .../check-runs` — needs
`checks: read`
- `sync-core.sh` restarts failed jobs via `gh api -X POST
.../actions/jobs/{id}/rerun` — needs `actions: write`
- `reusable-promote.yml` uses `trstringer/manual-approval` with
`github.token`, which opens an approval issue — needs `issues: write`

This mirrors each reusable workflow's declared permissions onto its
caller so the flip is safe. Note `sync-upstream-rebase.yml` runs on a
schedule, so a regression here would surface as a silent failure rather
than a red PR.

https://claude.ai/code/session_01Rg3UBFSnmKMPQLNpNKkn8d

Author: philippemnoel

.github/workflows/sync-promote-branch.yml

@@ -17,6 +17,12 @@ concurrency:
   group: promote-branch
   cancel-in-progress: false
 
+permissions:
+  actions: write
+  contents: write
+  issues: write
+  pull-requests: read
+
 jobs:
   call-promote:
     uses: paradedb/actions/.github/workflows/reusable-promote.yml@v8

.github/workflows/sync-upstream-rebase.yml

@@ -15,6 +15,13 @@ concurrency:
   group: upstream-rebase
   cancel-in-progress: false
 
+permissions:
+  actions: write
+  checks: read
+  contents: write
+  issues: write
+  pull-requests: read
+
 jobs:
   call-rebase:
     uses: paradedb/actions/.github/workflows/reusable-rebase.yml@v8