ci: add missing permissions blocks to workflow files (#211)

Add explicit permissions blocks following the principle of least
privilege to 4 workflow files that were missing them:

- test.yml: contents: read (only reads code and runs tests)
- npm-publish.yml: contents: read top-level, contents: write for
  create-release-notes job that updates GitHub releases
- macos-testing.yml: contents: read top-level, pull-requests: write
  for generate-report job that posts PR comments
- publish-pro.yml: contents: read top-level (publish job already had
  job-level contents: write)

This aligns with GitHub's security hardening recommendations:
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

Closes #210

Author: nikolasdehor

.github/workflows/macos-testing.yml

@@ -32,6 +32,9 @@ concurrency:
   group: macos-testing-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # Job 1: Intel Mac Testing
   test-intel-mac:
@@ -213,6 +216,9 @@ jobs:
     runs-on: macos-latest
     needs: [test-intel-mac, test-apple-silicon, test-error-recovery]
     if: always()
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: Checkout repository

.github/workflows/npm-publish.yml

@@ -33,6 +33,9 @@ concurrency:
   group: npm-publish-${{ github.ref }}
   cancel-in-progress: false  # Never cancel publishing in progress
 
+permissions:
+  contents: read
+
 env:
   NODE_VERSION: '20'
   NPM_REGISTRY: 'https://registry.npmjs.org/'
@@ -342,6 +345,8 @@ jobs:
     needs: [build, publish, publish-aios-install]
     if: github.event_name == 'release' && (needs.publish.result == 'success' || needs.publish-aios-install.result == 'success')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/publish-pro.yml

@@ -26,6 +26,9 @@ on:
     tags:
       - 'pro-v*'
 
+permissions:
+  contents: read
+
 jobs:
   # ─────────────────────────────────────────────────────────────────────────────
   # Quality Gates - Must pass before publish

.github/workflows/test.yml

@@ -17,6 +17,9 @@ concurrency:
   group: test-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   NODE_VERSION: '20'