Add least-privilege permissions to workflows missing them

.github/workflows/CommitMessage.yml

@@ -3,6 +3,12 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+  # pull-requests: write lets the sticky-comment step post and clear the
+  # commit-message feedback comment on the PR.
+  pull-requests: write
+
 jobs:
   gitlint:
     name: Check commit messages

.github/workflows/base-installer-cd.yml

@@ -43,6 +43,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  # contents: write is required to tag the repo and publish the GitHub Release
+  # (softprops/action-gh-release); no other GITHUB_TOKEN write is needed here.
+  contents: write
+
 jobs:
   debug_build_and_test:
     env:

.github/workflows/check-whitespace.yml

@@ -9,6 +9,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     check-whitespace:
         runs-on: ubuntu-latest

.github/workflows/link-check.yml

@@ -4,6 +4,9 @@ on:
     pull_request:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     lychee:
         runs-on: ubuntu-latest

.github/workflows/openspec-validate.yml

@@ -6,6 +6,9 @@ on:
       - 'openspec/**'
       - '**/AGENTS.md'
 
+permissions:
+  contents: read
+
 jobs:
   validate-refs:
     runs-on: windows-2022

.github/workflows/stray-docs.yml

@@ -8,6 +8,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     stray-docs:
         runs-on: ubuntu-latest