Fix CodeQL code scanning alerts

[dduugg]

Alerts #1, #2, #4 (actions/missing-workflow-permissions): give each
reusable-workflow caller job an explicit least-privilege permissions
block, matching the existing style in codeql.yml. Because a caller's
permissions are the ceiling for the called workflow, each grant covers
exactly what shared-config's workflow does:

• cd.yml -> contents: write. shared-config's cd.yml checks out with
  persisted credentials and runs publish-rubygems-action (rake release
  pushes the tag) followed by gh release create.
• stale.yml -> issues: write + pull-requests: write. actions/stale
  comments on and closes both stale issues and stale PRs.
• triage.yml -> issues: write. The called workflow only runs
  gh issue edit --add-label triage.

ci.yml already declares contents: read and codeql.yml already declares
its own scopes, so both are untouched.

Alert #5 (rb/polynomial-redos): /#.pack_public:\strue/ has no anchor,
so a line of many '#' characters makes the engine rerun the .* scan from
every '#', which is quadratic. Only the sigil's existence matters and .
never crosses a newline, so any '#' that can start a match implies the
line's first '#' can too. Look up the first '#' with String#index and
search from just past it, and drop the '#.*' prefix from
PUBLICIZED_SIGIL_REGEX so the constant is now the whitespace-tolerant
regex form of its sibling PUBLICIZED_SIGIL. Verified equivalent against
the old regex over 2M randomly generated single-line inputs, and pinned
the '#'-must-precede-the-sigil behaviour with new cases in the existing
content_contains_sigil? test.

Alerts resolved

• #5 rb/polynomial-redos (high) — lib/packwerk/privacy/checker.rb:38
• #4 actions/missing-workflow-permissions (medium) — .github/workflows/cd.yml:11
• #2 actions/missing-workflow-permissions (medium) — .github/workflows/stale.yml:8
• #1 actions/missing-workflow-permissions (medium) — .github/workflows/triage.yml:9

Verification

• Every job in every flagged workflow now has an effective permissions: block (cross-checked by parsing the YAML against the alert list).
• actionlint output is byte-identical to main — no new findings introduced.
• Test suite, type check and linter all pass locally.
• Regex/argv rewrites were fuzz-checked for exact equivalence against the originals.
• codeql.yml untouched.