Backport workflow-hardening fix (excessive-permissions) to 3 release branches

Summary

The default branch already hardened .github/workflows/pre-commit.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• https://github.com/meta-llama/llama-stack/commit/8fa77bc93e1bfde2b5b418c093ca070a2e86321b

Affected release branches (3)

• release-0.2.15 (still present as of HEAD 5cc44dac)
• release-0.2.14 (still present as of HEAD 1d82a3b8)
• release-0.2.13 (still present as of HEAD 73a9bddc)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

File .github/workflows/pre-commit.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,3 +43,6 @@
             echo "$unstaged_files"
             exit 1
           fi
+    permissions:
+      contents: write
+      pull-requests: write

File .github/workflows/pre-commit.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,3 +43,6 @@
             echo "$unstaged_files"
             exit 1
           fi
+    permissions:
+      contents: write
+      pull-requests: write

File .github/workflows/pre-commit.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,3 +43,6 @@
             echo "$unstaged_files"
             exit 1
           fi
+    permissions:
+      contents: write
+      pull-requests: write

Happy to open pull requests instead if that's preferred.