fix(ci): add permissions block to release workflow

GITHUB_TOKEN needs explicit contents: write to create releases via
softprops/action-gh-release. Without it, the API returns 403.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/release.yml

@@ -25,6 +25,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: validate
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4