ci: grant contents:read to the publish job

Specifying a job-level permissions block resets every unlisted scope to
none. Restore the contents:read access that actions/checkout relies on,
matching the build jobs in this workflow.

https://claude.ai/code/session_013tt2ucFPTnTnGGM1RLG19m

Author: claude

.github/workflows/deploy.yaml

@@ -472,6 +472,7 @@ jobs:
     environment: release
 
     permissions:
+      contents: read
       id-token: write # needed for crates.io Trusted Publishing
 
     steps: