AI spam

[Alb3e3]

This tightens the GitHub Actions workflow security posture without changing the test, pre-commit, or publish behavior.

• set read-only contents permissions for workflows that only need repository checkout access
• keep the existing job-specific permissions for release creation and PyPI trusted publishing
• avoid direct GitHub context interpolation in the release creation shell command

I verified the workflow YAML still parses, git diff --check passes, and zizmor no longer reports the previous excessive-permissions or template-injection findings.