Add shared release workflow from reissue

[cseeman]

Summary

• Adds shared release workflow from reissue for trusted publishing to RubyGems.org

Business Justification

Standardizes gem release process across SOFware repos using the shared reissue workflow, enabling automated trusted publishing to RubyGems.org via workflow_dispatch.

Technical Details

Adds .github/workflows/release.yml that calls SOFware/reissue/.github/workflows/shared-ruby-gem-release.yml@main

[cseeman]

Added on RubyGems Trusted Publishers
GitHub Repository: SOFware/close_encounters
Workflow Filename: shared-ruby-gem-release.yml
Workflow Repository: SOFware/reissue

In general, the fix is to explicitly specify a permissions block for the workflow or for the release job so the GITHUB_TOKEN is not implicitly granted broad repository defaults. Since this workflow only delegates to a reusable workflow via uses:, the safest, non‑breaking approach is to define minimal permissions at the job level, letting the reusable workflow request any additional fine-grained permissions it truly needs (if it does so). As a conservative baseline consistent with GitHub’s recommendations, we can grant read-only access to repository contents (and nothing else) in this caller workflow.

Concretely, in .github/workflows/release.yml, within the jobs: section, add a permissions: block under the release job (i.e., at the same indentation level as uses:) with contents: read. This ensures that the release job’s GITHUB_TOKEN is limited unless the called workflow itself defines additional permissions. No imports or external methods are needed; this is a pure YAML configuration change. The only lines to change are around the release job definition, inserting the new permissions block without modifying the existing uses or with configuration.