reduce permission scope

Author: stephen-derosa

.github/workflows/builds.yml

@@ -37,7 +37,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 env:
   CARGO_TERM_COLOR: always
@@ -310,6 +309,9 @@ jobs:
     name: Build (docker-linux-x64)
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout (with submodules)
@@ -396,6 +398,9 @@ jobs:
     name: Build (docker-linux-arm64)
     runs-on: ubuntu-24.04-arm
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout (with submodules)