ci: add contents write permission for publish job

The GITHUB_TOKEN needs explicit write permission to create GitHub
releases and push tags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: xotahal

.github/workflows/ci.yml

@@ -21,6 +21,8 @@ jobs:
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
         with: