Every workflow declares its own permissions block

## Summary

Add explicit `permissions:` blocks to `pre-commit.yml` and `haskell-ci.yml`,
the only two workflows across the Terraform-managed repositories that inherit
the repository default token.

## Motivation

An audit for alunduil/alunduil-infrastructure#165 (PR
alunduil/alunduil-infrastructure#372) read all 35 workflow files across the
eleven managed repositories. 33 declare `permissions:` at the workflow top
level or on every job, where an explicit block overrides the repository
default outright. The two that don't are both here.

Both are safe today: they check out, build, test, and cache, and that PR sets
the repository default to read-only, so they receive a read token. The gap is
that they are safe by inheritance rather than by declaration — a step added
later that needs write would quietly receive one if the default ever widened,
and nothing in the file states the intent.

## Scope

- Add `permissions: contents: read` to `pre-commit.yml`.
- Decide how `haskell-ci.yml` gets one. It is generated by
`haskell-ci regenerate`, so a hand-added block is overwritten on the next
run; this rides whichever ownership boundary #119 settles on.

## Acceptance criteria

- [ ] `pre-commit.yml` declares `permissions:`.
- [ ] `haskell-ci.yml` declares `permissions:` in a form that survives
`haskell-ci regenerate`.
- [ ] No workflow in the repo relies on the repository default token.

## Additional context

The `haskell-ci.yml` half overlaps #119, which is choosing the ownership
boundary for that file between `haskell-ci regenerate` and Renovate. A
`permissions:` block is another line those two tools would contend over, so it
belongs in that decision rather than being bolted on separately.

The `actions/cache` steps are unaffected either way — Actions cache access
runs on `ACTIONS_RUNTIME_TOKEN`, not `GITHUB_TOKEN`.