enhancement(ci): least-privilege token scope for test workflows

[MAfarrag]

Context

Security review; fixed in PR #28.

Problem

test-mkdocs-deploy.yml and test-release-github.yml granted contents: write (+ pages: write) though their jobs
only push to the local fake remote and set skip-github-release: 'true'. deploy-docs.yml requested an unused
pages: write (mike pushes gh-pages over git, not via the Pages API).

Affected locations

File	Location
.github/workflows/test-mkdocs-deploy.yml	permissions:
.github/workflows/test-release-github.yml	permissions:
.github/workflows/deploy-docs.yml	permissions:

Fix (PR #28)

Reduced the two test workflows to contents: read (with a comment documenting the skip-github-release coupling);
dropped the unused pages: write from deploy-docs.yml.

Severity / Effort

Low · XS

Definition of Done

• Test workflows default to contents: read
• No unused pages: write