ci: Add explicit permissions to workflows

[Mrtenz]

This fixes a bunch of CodeQL alerts.

---

Note

Low Risk
Low risk: only GitHub Actions workflow permission scopes are tightened/declared, with no application/runtime code changes. Potential risk is limited to CI failures if any job implicitly relied on broader default GITHUB_TOKEN permissions.

Overview
Adds explicit default permissions: contents: read to reusable CI workflows (build-lint-test.yml, main.yml, publish-release.yml) to satisfy security/CodeQL guidance.

Hardens the aggregator jobs in main.yml by setting permissions: {} for all-jobs-completed and all-jobs-pass, ensuring they run with no token privileges unless explicitly needed.

^{Reviewed by Cursor Bugbot for commit df29b67. Bugbot is set up for automated code reviews on this repo. Configure here.}