fix: use explicit contents:read permission instead of empty block

permissions: {} removes all scopes including contents:read, which
breaks actions/checkout on private repos. Grant the minimal required
permission explicitly.

https://claude.ai/code/session_013DBSzYMmxuKo9vsjMwXzJQ

Author: claude

.github/workflows/uv-tests.yml

@@ -10,7 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 env:
   COLUMNS: 200