fix(ci): remove workflow-level permissions from reusable workflows

.github/workflows/ci-integration.yml

@@ -3,9 +3,6 @@ name: Integration Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   # ── Integration test matrix ─────────────────────────────────────────
   # Each test-group runs on a SEPARATE runner per OS, giving full process

.github/workflows/ci-quality.yml

@@ -3,9 +3,6 @@ name: Quality Checks
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   typecheck:
     runs-on: ubuntu-latest

.github/workflows/ci-unit-tests.yml

@@ -3,10 +3,6 @@ name: Unit Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-  pull-requests: write
-
 jobs:
   unit-tests:
     name: unit (ubuntu / coverage)

.github/workflows/ci.yml

@@ -7,10 +7,6 @@ on:
     branches: [main]
   workflow_call:
 
-permissions:
-  contents: read
-  pull-requests: write
-
 # ── Reusable workflow orchestration ─────────────────────────────────
 # Each concern lives in its own workflow file for maintainability:
 #   ci-quality.yml       — typecheck (tsc --noEmit)

.github/workflows/publish.yml

@@ -5,6 +5,11 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+  id-token: write
+  pull-requests: write
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml