ci: add explicit permissions blocks to all workflow files

[Copilot]

GitHub Actions workflows without explicit permissions blocks inherit repository/org defaults, which may grant read-write GITHUB_TOKEN access — violating least privilege (CWE-275). Fixes 25 CodeQL actions/missing-workflow-permissions alerts across 18 workflow files.

Changes

• contents: read — added to 13 workflows that only need checkout/build: lint.yml, minimal-build.yaml, mypy-validation.yml, protocol_compatibility.yaml, qemu.yaml, restyled.yml, smoketest-android.yaml, spell.yml, unit_integration_test.yaml, zap_regeneration.yaml, zap_templates.yaml, tests.yaml
• contents: write — set on 3 workflows that write back to the repo or create releases: release_artifacts.yaml (uploads release assets), roll_and_build_docker.yaml (commits docker version bump), tag-releases.yaml (creates tags via gh)
• contents: read + packages: write — set on docker_img.yaml, which optionally pushes images to ghcr.io
• permissions: {} — set on pr-validation.yaml and third-party-check.yaml, which need no token access at all

# Example: workflow-level block added before `jobs:`
permissions:
  contents: read

jobs:
  ...

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
connectedhomeip	Error		Jul 19, 2026 5:08am
mcbride-enterprise-intelligence-dashboard	Error		Jul 19, 2026 5:08am