ci: add least-privilege GITHUB_TOKEN permissions to CI workflow

[seonghobae]

Summary

Resolves CodeQL actions/missing-workflow-permissions alerts #16, #17, #18 (CWE-275) on .github/workflows/ci.yml.

Root cause

The CI workflow defined no permissions block, so all three jobs (python, rust, package) inherited the repository/org default GITHUB_TOKEN scopes. For repos/orgs created before Feb 2023 the default is read-write, violating least privilege.

Fix

Added a top-level permissions: contents: read block. All three jobs only actions/checkout the repo and run build/test steps (pytest, cargo test, python -m build, twine check, smoke scripts) — none push commits, comments, packages, or releases, so read-only contents is sufficient for every job.

No workflow thresholds or steps were weakened.

[seonghobae]

Closing as superseded by lower-numbered PR #118. #121 contains the same CI workflow permissions: contents: read declaration, while #118 carries that identical least-privilege CI change plus the .codegraph/ ignore guard for review-generated artifacts.