Address CodeRabbit review feedback on workflow permissions.

Scope actions: write to the build job that saves the cache, and grant
pull-requests: write so compressed-size-action can post PR comments.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

.github/workflows/ci.yml

@@ -14,7 +14,6 @@ env:
   BUILD_CACHE_KEY: ${{ github.sha }}-dist
 
 permissions:
-  actions: write
   contents: read
   pull-requests: read
 
@@ -31,6 +30,9 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     name: Build & Validate
     steps:
       - uses: actions/checkout@v6

.github/workflows/size.yml

@@ -12,7 +12,7 @@ env:
 
 permissions:
   contents: read
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   compressed-size: