ci: gate coverage publish on push events

coverage-action with publish: true always tries to push to _xml_coverage_reports,
but fork PRs get a read-only GITHUB_TOKEN regardless of the permissions block.
Gate publish on push events so fork PRs skip the write step entirely.
pull-requests: write is kept for PR annotations.

Signed-off-by: Erik Nilsen <enilsen16@live.com>

Author: enilsen16

.github/workflows/ci-rust.yml

@@ -37,6 +37,9 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
@@ -70,7 +73,7 @@ jobs:
           path: rsworkspace/coverage.xml
           threshold: 95
           fail: true
-          publish: true
+          publish: ${{ github.event_name == 'push' }}
           diff: true
           diff-branch: main
           diff-storage: _xml_coverage_reports