Scope create-release workflow token permissions explicitly

[Copilot]

This change addresses the code scanning finding on .github/workflows/create-release.yml by removing reliance on default GITHUB_TOKEN permissions. The release job now declares the minimum repository access it needs to publish a GitHub release.

• What changed

  • Added an explicit job-level permissions block to the github release job.
  • Scoped the token to contents: write, which is required for softprops/action-gh-release to create/update releases.

• Why this matters

  • Makes workflow privileges explicit and least-privilege by default.
  • Resolves the actions/missing-workflow-permissions alert on the release workflow.

• Relevant diff

  github:
    name: GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write