Add least-privilege permissions to workflows missing them

Six workflows declared no permissions block and fell back to the
repository default GITHUB_TOKEN scope, which can be broader than the job
needs. Declare an explicit block on each so the token is scoped to the
work the job actually does.

The base installer gets contents: write to tag and publish its Release,
the commit-message check gets contents: read plus pull-requests: write
for its sticky comment, and link-check, openspec-validate,
check-whitespace, and stray-docs get contents: read only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jasonleenaylor

.github/workflows/CommitMessage.yml

@@ -3,6 +3,12 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+  # pull-requests: write lets the sticky-comment step post and clear the
+  # commit-message feedback comment on the PR.
+  pull-requests: write
+
 jobs:
   gitlint:
     name: Check commit messages

.github/workflows/base-installer-cd.yml

@@ -43,6 +43,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  # contents: write is required to tag the repo and publish the GitHub Release
+  # (softprops/action-gh-release); no other GITHUB_TOKEN write is needed here.
+  contents: write
+
 jobs:
   debug_build_and_test:
     env:

.github/workflows/check-whitespace.yml

@@ -9,6 +9,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     check-whitespace:
         runs-on: ubuntu-latest

.github/workflows/link-check.yml

@@ -4,6 +4,9 @@ on:
     pull_request:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     lychee:
         runs-on: ubuntu-latest

.github/workflows/openspec-validate.yml

@@ -6,6 +6,9 @@ on:
       - 'openspec/**'
       - '**/AGENTS.md'
 
+permissions:
+  contents: read
+
 jobs:
   validate-refs:
     runs-on: windows-2022

.github/workflows/stray-docs.yml

@@ -8,6 +8,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     stray-docs:
         runs-on: ubuntu-latest