ci: give every workflow an explicit least-privilege GITHUB_TOKEN

CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.

.github/workflows/push-master.yml

@@ -4,6 +4,11 @@ on:
     branches:
       - master
 
+
+# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
+permissions:
+  contents: read
+
 jobs:
   master:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"