ci: grant contents:write so release upload step can attach the zip

The build job's "Upload to Release" step failed with HTTP 403
"Resource not accessible by integration" because the default
GITHUB_TOKEN is read-only. Add top-level permissions: contents: write.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -7,6 +7,12 @@ on:
   release:
     types: [published]
 
+# Default GITHUB_TOKEN is read-only; the build job's "Upload to Release" step
+# needs contents:write to attach the built zip as a release asset (else HTTP 403
+# "Resource not accessible by integration").
+permissions:
+  contents: write
+
 jobs:
   test:
     runs-on: windows-latest