ci: Consolidate permissions at workflow level

Standardize on a single workflow-level permissions block per workflow
rather than a mix of workflow- and job-level declarations.

Where a job declared its own block, the workflow-level block is the
union of what every job needs, since job-level permissions replace
workflow-level rather than merging with it.

Claude-Session: https://claude.ai/code/session_01Rg3UBFSnmKMPQLNpNKkn8d

Author: philippemnoel

.github/workflows/release.yml

@@ -25,13 +25,14 @@ concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   release:
     name: Build and Publish to PyPI
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
 
     steps:
       - name: Validate confirmation