Three workflows have no explicit permissions block

Description

Three workflows have no permissions: block, so the GITHUB_TOKEN handed to them falls back to the repository/org default rather than being scoped to what they need:

• .github/workflows/typecheck.yml
• .github/workflows/storybook.yml
• .github/workflows/notify-discord.yml

Every other workflow in the repo pins its scopes — deploy.yml sets them at the top level, review.yml, pr-management.yml and pr-standards.yml set them per job — so these three look like oversights rather than intent.

None of them need write access. typecheck checks out and runs bun typecheck, storybook checks out and builds, and notify-discord only forwards the release payload to a Discord webhook. contents: read covers all three.

This is hardening rather than a live bug: if the repository default is already read-only, behaviour doesn't change. It just stops these workflows from silently gaining write scopes if that default is ever widened.

Steps to reproduce

grep -L "permissions:" .github/workflows/*.yml lists the three files above.