ci: declare read-only workflow token permissions (#31836)

.github/workflows/computer-e2e.yml

@@ -68,6 +68,9 @@ concurrency:
   group: computer-e2e-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   native-smoke:
     if: github.event_name == 'pull_request' && github.event.pull_request.draft != true

.github/workflows/golden-e2e-experiment.yml

@@ -8,6 +8,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   golden-e2e:
     name: golden e2e ${{ matrix.platform }} experiment

.github/workflows/linux-wayland-gpu-sandbox.yml

@@ -3,6 +3,9 @@ name: Linux Wayland GPU Sandbox
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   verify:
     name: wayland terminal input

.github/workflows/mobile-ios-release.yml

@@ -23,6 +23,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   ios-build:
     # GitHub-hosted macOS runner: required for Xcode. Expo SDK 55's

.github/workflows/mobile.yml

@@ -97,6 +97,9 @@ concurrency:
   group: mobile-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   verify:
     name: Mobile verify

.github/workflows/skill-update-roundtrip.yml

@@ -27,6 +27,9 @@ concurrency:
   group: skill-roundtrip-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   roundtrip:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true

.github/workflows/terminal-perf.yml

@@ -48,6 +48,9 @@ on:
     # terminal throughput regressions are caught before users report typing lag.
     - cron: '30 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   terminal-perf:
     name: terminal scale perf