ci: set read-only workflow token permissions

[Alb3e3]

Summary

• set explicit read-only GITHUB_TOKEN permissions for CI workflows that only need repository checkout/read access
• leave release/deploy/write-capable workflows unchanged

Why

This follows GitHub Actions least-privilege guidance and reduces the default token scope available to routine CI jobs without changing the test/build commands.

Verification

• Parsed the changed workflow YAML with PyYAML.
• Ran git diff --check.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1