Fix excessive-permissions violations and re-enable zizmor audit (follow-up to #13411)

#13411 added zizmor but globally disabled the `excessive-permissions` rule in `.github/zizmor.yml` (`disable: true`, currently suppressing 73 findings, no rationale comment).

Work:
- [ ] Add top-level `permissions: {}` defaults + explicit job-level grants to each workflow
- [ ] Remove the global disable from `.github/zizmor.yml` (and annotate with tracking link until then)

Inspect the workflow files under .github and .github/zizmor.yml, starting with the disabled excessive-permissions rule and the 73 suppressed findings. Run the zizmor audit while reviewing each job's required access; done means top-level empty permissions, explicit job-level grants, and the global disable removed with the audit passing.

Written by the indexing model from the issue text.