fix(ci): drop unused deployments:write permission from deploy job (#99)

Scorecard Token-Permissions (code-scanning alert #15) flagged the deploy
job's job-level `deployments: write`. No step uses GitHub's Deployments
API — the `environment: production` record is created by GitHub itself,
and wrangler-action deploys to Cloudflare Pages without touching it. The
remaining id-token/attestations writes are required by attest-build-provenance.

Author: kellenmurphy

.github/workflows/ci.yml

@@ -143,7 +143,6 @@ jobs:
         environment: production
         permissions:
             contents: read
-            deployments: write
             id-token: write
             attestations: write
         steps: