Scope GITHUB_TOKEN permissions in create-release conda job

[Copilot]

This PR addresses code scanning alert #9 (actions/missing-workflow-permissions) in the release workflow by removing implicit default token scope. It applies explicit least-privilege permissions to the affected job.

• Alert remediation (.github/workflows/create-release.yml)

  • Added explicit permissions on the conda job.
  • Scoped token access to the minimum required for release asset publishing (contents: write).

• Behavioral impact

  • No workflow logic/path changes; only token permission scope is made explicit.

conda:
  runs-on: ${{ matrix.os }}
  permissions:
    contents: write