[rennf93]

Closes the CodeQL actions/missing-workflow-permissions alerts #1, #2, #3, #4, #5.

ci.yml, scheduled-lint.yml had no permissions: block, so every job without its own block ran with the default token. Each now starts with a top-level permissions: contents: read. The existing job-level blocks are untouched and still replace it for their own job. I went through every job that has no block of its own: they check out, install and run, and none comments, pushes, releases or calls the API. The org default token is already read-only, so the runs behave the same; the block makes it explicit per workflow.

scheduled-lint.yml also had a real bug: the steps run under bash -e, so a failing pre-commit or pymarkdownlnt ended the step before EXIT_CODE=$? ran. The status and output were never written and the log showed nothing, because the output went to a file. The exit code is now kept with || EXIT_CODE=$?, the captured output is printed, and $GITHUB_OUTPUT is quoted and written once (shellcheck SC2086, SC2129).

Closes the CodeQL actions/untrusted-checkout/high alert #6 on registry-publish.yml. On workflow_run the job checks out workflow_run.head_sha and runs it with id-token: write. The upstream "Publish to PyPI" workflow only runs on release and workflow_dispatch today, but nothing in this workflow enforced that. The job now also requires workflow_run.head_repository.full_name == github.repository and a triggering event of release or workflow_dispatch, so a run started from a fork or from another event can never reach the checkout. Manual dispatch is unchanged.

Checked: actionlint passes on every changed workflow. The CodeQL run on this PR is the check that the alerts close.