Add least-privilege permissions to workflows missing them

[jasonleenaylor]

What

Six workflows declared no permissions: block, so their GITHUB_TOKEN fell back to the repository/organization default scope. This adds an explicit least-privilege block to each.

Workflow	Permissions granted	Why
base-installer-cd.yml	contents: write	Tags the repo and publishes a GitHub Release (softprops/action-gh-release)
CommitMessage.yml	contents: read, pull-requests: write	Posts and clears a sticky PR comment
link-check.yml	contents: read	Checkout only
openspec-validate.yml	contents: read	Checkout only
check-whitespace.yml	contents: read	Checkout only
stray-docs.yml	contents: read	Checkout only

Why it matters

Without an explicit block, a workflow inherits whatever the default token permissions are. If that default is read/write (the legacy default), every one of these jobs — including ones that only lint or check out code — runs with a broadly-writable token. Declaring the minimum each job needs limits the blast radius if a step or a third-party action is compromised.

CI.yml and patch-installer-cd.yml already declared explicit permissions and are left unchanged.

Scope / validation

• Six workflow files; additive only (new permissions: blocks, no logic changes).
• All six validated with a YAML parser; resolved scopes confirmed to match the table above.

---

This is one of two PRs from a GitHub Actions security audit. The other PR (Randomize GITHUB_ENV delimiter in commit-message check) also edits CommitMessage.yml in a different region, so the two merge independently.

---

This change is 

[github-actions]

NUnit Tests

    1 files      1 suites   11m 48s ⏱️
5 778 tests 5 697 ✅ 81 💤 0 ❌
5 787 runs  5 706 ✅ 81 💤 0 ❌

Results for commit ffc0a6c.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.07%. Comparing base (08a02fd) to head (ffc0a6c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##           main    #1074       +/-   ##
=========================================
+ Coverage      0   38.07%   +38.07%     
=========================================
  Files         0     1499     +1499     
  Lines         0   350146   +350146     
  Branches      0    40239    +40239     
=========================================
+ Hits          0   133323   +133323     
- Misses        0   187544   +187544     
- Partials      0    29279    +29279     

see 1499 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.