chore(ci): harden GHA workflows with least-privilege permissions

[fzipi]

Summary

Hardens all GitHub Actions workflows with least-privilege permissions following security best practices.

Workflow	Changes
build.yml	Set top-level permissions: {} (deny-all); added job-level contents: read; expanded trigger to explicit push/pull_request with branches: [main]
package.yml	Moved contents: write + id-token: write from top-level to package job; added contents: read to install-test job; set top-level to permissions: {}; fixed expression injection by passing github.event.release.tag_name through env var
release.yml	Moved permissions from top-level to release-please job (contents: write, pull-requests: write); removed unnecessary issues: write; set top-level to permissions: {}
stale.yml	Moved permissions to job-level (issues: write, pull-requests: write); removed unnecessary contents: write; set top-level to permissions: {}