fix: add explicit permissions to workflow files

[0x46616c6b]

Type of Change

• Bugfix
• Enhancement / new feature
• Refactoring
• Documentation

Description

Add explicit permissions blocks to all three GitHub Actions workflow files to resolve open code scanning alerts (actions/missing-workflow-permissions, alerts #3, #12, #14).

Without an explicit permissions block, workflows inherit the default repository token permissions, which may be overly broad. This change follows the principle of least privilege by declaring only the minimum permissions each workflow needs:

Workflow	Permissions	Rationale
release.yml	contents: write	Release drafter needs write access to create/update draft releases
auto-merge.yml	contents: read	Minimal read-only — actual merge operations use the GitHub App token
cla.yml	contents: write, pull-requests: write, actions: read	CLA Assistant needs to push to the signatures branch, comment on PRs, and read workflow context

Checklist

• Write tests
• Make sure all tests pass
• Update documentation
• Review the Contributing Guideline and sign CLA
• Reference relevant issue(s) and close them after merging

---

_{The changes and the PR were generated by OpenCode.}