fix(ci): add contents:read permission for private repo checkout

Removed environment requirement and added explicit contents:read
permission to allow checkout action to access private repository.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: zircote

.github/workflows/publish.yml

@@ -9,8 +9,8 @@ jobs:
   publish:
     name: Build and Publish
     runs-on: ubuntu-latest
-    environment: release
     permissions:
+      contents: read  # Required to checkout private repo
       id-token: write  # Required for trusted publishing
 
     steps: