fix(security): least-privilege workflow permissions (SonarCloud New Code) (#58)

`main` is green as of #57. This addresses the one original red that had
gone unexamined all programme: **SonarCloud Quality Gate — `C Security
Rating on New Code` (required ≥ A)**.

## Getting the findings without dashboard access

SonarCloud's project is public, so its API lists them directly:

```
https://sonarcloud.io/api/issues/search?componentKeys=hyperpolymath_krl&types=VULNERABILITY
```

**15 vulnerabilities, all inside the new-code period.** Two are fixed
here — including one this programme introduced.

## Fixed

### `e2e.yml` — *"Replace `read-all` with specific permissions"*

**This one is mine.** `e2e.yml` was rewritten in #53 and carried the RSR
template's `permissions: read-all`. Narrowed to `contents: read`, which
is all four jobs need.

### `pages.yml` ×3 — *"Move this read/write permission from workflow
level to job level"*

The workflow granted `contents:read` + `pages:write` + `id-token:write`
to **both** jobs, but only `deploy` needs the pages and id-token scopes.
Now split per job:

| Job | Permissions |
|---|---|
| `build` | `contents: read` |
| `deploy` | `contents: read`, `pages: write`, `id-token: write` |

That matters here beyond satisfying the linter: the `build` job runs a
**container image** and executes the SSG over repository content. It
should not be holding deploy credentials while doing so.

## Not fixed — deliberately, so this stays reviewable

| Finding | Location |
|---|---|
| Only pass required secrets to this workflow | `secret-scanner.yml:18`,
`mirror.yml:12` |
| Dependencies without locked resolved versions | `release.yml:38` |
| Not enforcing HTTPS | `release.yml:91`,
`static-analysis-gate.yml:30,31,229,230`, `setup.sh:144,156` |
| Workflow-level permission | `static-analysis-gate.yml:11` |

**The rating will not reach A until those are triaged too.** Several of
the HTTPS findings may be false positives and need reading in context
before anything is changed — which is exactly why they aren't bundled
into a PR about permissions.

## Verified

`actionlint` **0** · K9 **0 errors** · A2ML **0 errors** · e2e 4/4 ·
aspect 4/4 · smoke 20/20

Author: hyperpolymath

.github/workflows/e2e.yml

@@ -27,7 +27,8 @@ on:
       - 'examples/**'
       - '.github/workflows/e2e.yml'
   workflow_dispatch:
-permissions: read-all
+permissions:
+  contents: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/pages.yml

@@ -5,15 +5,16 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Permissions are declared per job rather than at workflow level, so the build
+# job never holds the pages/id-token write scopes that only the deploy job
+# needs.
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 15
     container:
@@ -43,6 +44,10 @@ jobs:
         with:
           path: '_site'
   deploy:
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}