fix(security): workflow permissions + GitPython bump

.github/workflows/add-to-project.yml

@@ -2,6 +2,9 @@ name: Add issues to project
 on:
   issues:
     types: [opened, reopened]
+# The job authenticates with ADD_TO_PROJECT_PAT; GITHUB_TOKEN needs nothing.
+permissions:
+  contents: read
 jobs:
   add-to-project:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -21,6 +24,10 @@ jobs:
   changes:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      # dorny/paths-filter reads the PR's changed-file list via the API.
+      pull-requests: read
     outputs:
       code: ${{ steps.filter.outputs.code }}
       engine: ${{ steps.filter.outputs.engine }}

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     tags: ["v*.*.*"]
   workflow_dispatch:  # allow manual re-runs without re-tagging
 
+# Least-privilege default; the publish job grants itself id-token: write.
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build sdist + wheel