chore(ci): add least-privilege permissions to ci.yml

[memosr]

Summary

ci.yml is the only workflow in the repo without a top-level permissions: block, so its 10 jobs inherit the repository default token permissions. This adds contents: read, following the pattern finalize-release.yaml already uses: a restrictive top-level block, with jobs that need more declaring it themselves.

Why this is safe

Every job was audited before the change:

• The only GITHUB_TOKEN reference in the file is inside the proto job, which already declares its own permissions: block (contents: read + pull-requests: write, matching what bufbuild/buf-action documents). A job-level block fully replaces the workflow-level one, so proto is unaffected.
• No other job runs gh, uses actions/github-script, posts comments, pushes commits, uploads release assets, or pushes images. docker-build runs with push: false.
• Swatinem/rust-cache (via setup-rust-toolchain) and BuildKit's type=gha cache both authenticate with ACTIONS_RUNTIME_TOKEN, which is not governed by permissions:.
• taiki-e/install-action passes github.token only to relieve cargo-binstall rate limiting, read-only.
• The three submodules are public third-party repos fetched over HTTPS.

Scope

Two added lines, placed immediately before jobs: to mirror finalize-release.yaml. No job-level changes.

[osr21]

Audited the PR branch independently — the key claims hold:

Single GITHUB_TOKEN reference, correctly scoped. The only secrets.GITHUB_TOKEN use in the file is line 160 inside bufbuild/buf-action. The proto job at line 148 already declares its own permissions: block (contents: read + pull-requests: write), which fully replaces the workflow-level default for that job. buf-action's ability to post lint annotations on PRs is unaffected.

No other job needs write access. Checked every job: no gh calls, no actions/github-script posting comments, no pushes, no release asset uploads. Swatinem/rust-cache and BuildKit's type=gha both use ACTIONS_RUNTIME_TOKEN (separate from GITHUB_TOKEN, unaffected by permissions:). taiki-e/install-action passes github.token only for read-only rate-limiting; contents: read covers it.

Compatibility with PR #217. Both PRs modify ci.yml but touch entirely different lines — #217 replaces uses: @v<tag> references with SHAs, #218 adds three lines before jobs:. They apply cleanly in either merge order without conflicts.