fix workflow permissions: add explicit permissions blocks to release.yml, deploy.yml, _diffcalc_processor.yml

Author: Copilot

.github/workflows/_diffcalc_processor.yml

@@ -37,6 +37,8 @@ jobs:
     name: Run
     runs-on: self-hosted
     timeout-minutes: 1440
+    permissions:
+      contents: read
 
     outputs:
       target: ${{ steps.run.outputs.target }}

.github/workflows/deploy.yml

@@ -6,6 +6,8 @@ on:
       - '*.*.*'
       - '!*-*'
 
+permissions: {}
+
 jobs:
   notify_pending_production_deploy:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -45,6 +45,8 @@ on:
         default: ""
         type: string
 
+permissions: {}
+
 jobs:
   # ═══════════════════════════════════════════════════════════════════════════════
   # Determine version (shared across all platform jobs)