ci: declare contents:read on code-quality workflow

[arpitjain099]

Adds a workflow-level permissions: contents: read. The job checks out the repo and runs the linter / format checker; nothing here calls a GitHub API beyond the initial checkout, and the action surfaces failures as the workflow's own check status.

This is supply-chain hygiene anchored in CVE-2025-30066 - the March 2025 tj-actions/changed-files compromise - where a tampered third-party action read GITHUB_TOKEN out of workflow logs and the blast radius equalled whatever scope was issued. Pinning per workflow caps that runtime authority irrespective of the repo or org default, gives drift protection if the default ever widens, and is what OpenSSF Scorecard's Token-Permissions check credits. Small files like this one are the easy place to start the org-wide hygiene work.

YAML validated locally with yaml.safe_load.

---

Note

Low Risk
Narrowing workflow token scope only; no application or auth logic changes.

Overview
Adds workflow-level permissions: contents: read to the Code quality checks workflow in .github/workflows/code-quality.yml, so the job’s GITHUB_TOKEN is limited to what checkout and local lint/typecheck steps need instead of inheriting broader repo/org defaults.

This is supply-chain / least-privilege hygiene (aligned with OpenSSF Scorecard token-permissions expectations); behavior of the job steps is unchanged.

^{Reviewed by Cursor Bugbot for commit a7e82f6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: a7e82f6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[arpitjain099]

Merging mentally with #1040 which covers this plus more files. Closing this PR.