fix(ci): grant required permissions to execute-release caller (#798)

permissions: {} starved the GITHUB_TOKEN before any job could start,
causing startup_failure on every run since the workflow was introduced
on 2026-06-09. Same root cause as the promote-testing-to-main fix.

Top-level permissions must be a superset of what the reusable jobs need:
  actions: read       (check workflow runs)
  contents: write     (push stable tag / create release)
  id-token: write     (cosign OIDC signing in release-notes job)
  issues: write       (release gate comments)
  packages: write     (copy :testing → :stable in GHCR)
  pull-requests: write (update promotion PR)

Assisted-by: Claude Sonnet 4.5 via pi

Author: castrojo

.github/workflows/execute-release.yml

@@ -7,7 +7,13 @@ on:
     branches:
       - main
 
-permissions: {}
+permissions:
+  actions: read
+  contents: write
+  id-token: write
+  issues: write
+  packages: write
+  pull-requests: write
 
 jobs:
   execute: