ci: declare permissions on 5 workflows (lint, issues, semgrep, release-python-*)

.github/workflows/issues.yml

@@ -4,6 +4,9 @@ on:
   issues:
     types: [opened, labeled, transferred]
 
+# The project mutation uses secrets.DEVPROD_PAT, not GITHUB_TOKEN.
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to GH project

.github/workflows/lint.yml

@@ -13,6 +13,9 @@ concurrency:
   group: lint.yml-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-24.04

.github/workflows/release-python-runtime.yml

@@ -9,6 +9,12 @@ on:
         default: false
         type: boolean
 
+# The "Check for open PR and commit changes" step uses gh + git push,
+# both via GITHUB_TOKEN. R2 uploads use their own R2_* secrets.
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04

.github/workflows/release-python-snapshots.yml

@@ -9,6 +9,14 @@ on:
         default: false
         type: boolean
 
+# The "Check for open PR and commit changes" step uses gh + git push.
+# R2 uploads use their own R2_* secrets. The reusable _bazel.yml caller
+# declares its own permissions; this top-level block applies only to
+# the in-file jobs.
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   build-linux:
     uses: ./.github/workflows/_bazel.yml

.github/workflows/semgrep.yml

@@ -4,6 +4,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 name: Semgrep config
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep/ci