fix: scope per-callback permissions to the caller job (least-privilege)

[joshua-temple]

Problem

main already grants per-callback permissions: (e.g. id-token: write for OIDC) by unioning every callback's permission map into the top-level permissions: block of the generated workflow. That works, but it over-grants: every job in the workflow receives the elevated scopes, not just the one caller job that needs them. For OIDC this widens the blast radius well beyond the callback that requested id-token: write.

Fix

Scope each callback's declared permissions to its own reusable-workflow caller job instead of the top level:

• The top-level permissions: block now carries only cascade's own orchestration scopes (the historical base). Callback scopes are no longer merged in, so the collectCallbackPermissions union helper and the callbackUnion parameter of writeTopLevelPermissions are removed (no dead code).
• Each caller job whose callback declares a non-empty permissions: map gets a job-level permissions: block with exactly the declared scopes, sorted for deterministic output. A callback that declares nothing gets no job-level block and inherits the top-level base, so existing manifests are byte-identical.
• GitHub Actions allows permissions: on a reusable-workflow uses: caller job, and actionlint accepts it. The earlier wording claiming GitHub forbids it has been corrected.

Semantics

Job-level permissions replace the workflow default rather than merging. A callback's permissions: map is therefore the complete permission set for that job. cascade emits exactly what is declared and never injects an implicit scope (no auto contents: read). The configuration docs note this so users include contents: read for checkout and id-token: write for OIDC.

Verification

• go build ./..., go test ./... (1402 passing), golangci-lint run ./... all green.
• e2e module builds and vets clean; callback-permissions-oidc.yaml scenario rewritten to assert the job-level block carries the declared scopes and the top-level block excludes them.
• Regenerating this repo's own workflows produces a byte-identical permissions block (the manifest declares no callback permissions).
• actionlint accepts the generated job-level permissions: block.

Closes #182