chore(ci): give every workflow job explicit permissions

[jfrench9]

Closes the three open actions/missing-workflow-permissions code-scanning alerts (medium).

What changed

Three jobs ran on the repository's default token scope because they declared no permissions: block. Each now gets only what it actually uses:

Job	Permission	Why
test.yml → test	contents: read	checkout, then local tooling only
create-release.yml → create-release	contents: write	pushes the version commit to main and the release branch
create-release.yml → create-summary	contents: read	writes $GITHUB_STEP_SUMMARY and nothing else

I read create-release before scoping it: it does git push origin main and git push origin "$BRANCH_NAME", and makes no gh pr / gh release / gh api calls, so contents is genuinely all it needs — no pull-requests: or wider scope required.

Deliberately untouched

publish.yml already declares contents: read + id-token: write for PyPI trusted publishing, which is why it was never flagged. Narrowing it would break the publish, so it is left exactly as-is. create-tag likewise already had contents: write.

Validation

just test-all green — 526 passed / 17 skipped, ruff, basedpyright 0/0. Both workflow files parse as YAML and every job now resolves to an explicit permissions map.