添加顶级权限: 阻止 GitHub Actions 工作流程 (最低权限 GITHUB_TOKEN)

Most of our workflows don't declare a top-level `permissions:` block, so their `GITHUB_TOKEN` inherits whatever the repository-level default happens to be. That default can be widened by an admin without any diff or PR — the workflow itself gives no indication of what scope its token actually has at runtime.