Restrict default token permissions in create-release workflow

[Copilot]

This change addresses the code scanning finding on create-release.yml by explicitly denying unused GITHUB_TOKEN permissions in the release tagging path. The affected job already authenticates with secrets.PYPCAPKIT, so the workflow now documents and enforces that narrower permission model.

• Workflow permissions

  • Add an explicit empty permissions block to the tag job in .github/workflows/create-release.yml
  • Prevent the job from inheriting repository/org default GITHUB_TOKEN scopes

• Release tagging path

  • Preserve the existing authentication flow based on secrets.PYPCAPKIT
  • Leave release creation and package publishing behavior unchanged

tag:
  name: Conda Tag
  runs-on: ubuntu-latest
  permissions: {}