ci: adopt deny-all top-level workflow permissions (#155)

Sets each workflow's top-level `permissions:` to `{}` (deny-all) and
moves the previously top-level grants into the specific jobs that
inherited them. **Effective permissions are unchanged for every job** —
this just makes the grants explicit per job so a newly-added job can't
silently inherit broad scopes.

Behavior-preserving mechanical change (validated: all touched workflows
still parse; per-job effective scopes identical). Workflows whose jobs
inherit the org default are left untouched for a manual per-job pass.

_Flagged by github-maintenance Workflow Permissions Audit._

Author: mscolnick

.github/workflows/demo.yml

@@ -5,8 +5,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   build:
@@ -38,6 +37,8 @@ jobs:
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: './demo/dist'
+    permissions:
+      contents: read
 
   deploy:
     name: 🚀 Deploy

.github/workflows/release.yml

@@ -1,7 +1,6 @@
 name: Release
 
-permissions:
-  contents: read
+permissions: {}
 
 on:
   push:
@@ -73,6 +72,8 @@ jobs:
             LICENSE
           retention-days: 1
           if-no-files-found: error
+    permissions:
+      contents: read
 
   publish:
     needs: build
@@ -131,3 +132,5 @@ jobs:
           status: ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 'failure' || 'success' }}
           slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL_RELEASES }}
           artifact-url: "https://npmjs.com/package/@marimo-team/codemirror-sql"
+    permissions:
+      contents: read