fix(ci): grant contents: write only to the release jobs that edit the release

The release workflow granted contents: write to every job, including the distro builds and the self-hosted verify job, which only read. Only release, promote, mark-failed and iso create or edit the GitHub release, so they alone get write and the rest default to read.

.github/workflows/release.yml

@@ -5,7 +5,7 @@ on:
     tags: [ "v*" ]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   distro-amd64:
@@ -133,6 +133,8 @@ jobs:
   release:
     needs: [ distro-amd64, distro-arm64 ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     steps:
       - name: Download amd64 Artifacts
         uses: actions/download-artifact@v8.0.2
@@ -248,6 +250,8 @@ jobs:
   promote:
     needs: [ verify, baremetal ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -280,6 +284,8 @@ jobs:
     needs: [ verify, baremetal ]
     if: failure()
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -297,6 +303,8 @@ jobs:
   iso:
     needs: release
     runs-on: [ self-hosted, ci-single ]
+    permissions:
+      contents: write
     # ISO build (~60-90m) overlaps the parallel baremetal run (~120m); the
     # upload gate then waits for baremetal to finish, so the job must outlast it.
     timeout-minutes: 180