ci: add least-privilege workflow permissions (CodeQL)

[jhamon]

Summary

• Adds a top-level permissions: contents: read block to .github/workflows/ci.yml
• Both jobs (linting and run-tests) are read-only CI; no write permissions are needed
• Resolves CodeQL actions/missing-workflow-permissions alerts Private datasets with user auth #6 and Hotfix load fails #7

Closes PIN-24

---

Note

Low Risk
Single-line workflow hardening with no application or runtime changes; verify upload-artifact still succeeds under the narrowed token if CI fails post-merge.

Overview
Adds an explicit workflow-level permissions: contents: read block to ci.yml, replacing the implicit broad default for the GITHUB_TOKEN on push/PR to main.

This scopes both linting and run-tests to read-only repository access, matching jobs that only checkout code, run checks/tests, and use secrets—addressing CodeQL actions/missing-workflow-permissions (alerts #6 and #7).

^{Reviewed by Cursor Bugbot for commit cfb8343. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 463a52b. Configure here.}