Audit and tighten GITHUB_TOKEN permissions on CI workflows

The repository default for `GITHUB_TOKEN` is `default_workflow_permissions: write` and `can_approve_pull_request_reviews: true`. The majority of workflows do not declare an explicit `permissions:` block, so they inherit broad write access (and PR-approve) regardless of what they actually need.

## Workflows currently lacking explicit `permissions:`

- `claude-issue-to-pr.yml`, `claude-mention.yml`, `claude-review.yml`
- `validate-caller-workflows.yml`
- `create-release.yaml`
- `integration-tests.yaml`
- `lint-code.yaml`
- `notify-release-published.yaml`
- `publish-docker.yaml`
- `publish-npm.yaml`

Workflows that already scope permissions: `cherry-pick-patch.yml`, `sync-core.yaml`, `report-cherry-pick-tests.yml`.

Same gap exists in `HarperFast/harper-pro` (workflows mirror via `sync-core`).

## Asks

- Set top-level `permissions:` on every workflow with the minimum scopes it needs. Recommend default-deny (`permissions: {}` at the workflow level, then job-level grants where needed).
- Consider flipping repo defaults to `default_workflow_permissions: read` (and disabling `can_approve_pull_request_reviews`) once all workflows declare what they need.
- Document the convention so future workflows opt-in to required scopes.

## Acceptance criteria

- Every workflow file declares an explicit `permissions:` block.
- CI passes after the tightening (workflows that need `contents: write`, `pull-requests: write`, `packages: write`, etc. continue to function).
- Repo-level default flipped to `read` once individual workflow scopes are in place.

## Notes for reviewer

- Release workflows (`create-release.yaml`, `publish-npm.yaml`, `publish-docker.yaml`) need write on `contents` / `packages`.
- Claude workflows (`claude-issue-to-pr.yml`, `claude-mention.yml`, `claude-review.yml`) need `pull-requests: write`, `issues: write`, and `contents: write` for branch pushes.
- Test/lint workflows likely need only `contents: read`.

---

Tracked in Jira: [CORE-3054](https://harperdb.atlassian.net/browse/CORE-3054)

🤖 Filed by Claude on behalf of Kris.