Scoped GITEA_TOKEN to least privilege in Gitea Actions workflows.

.gitea/workflows/audit.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     paths: [uv.lock]
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Dependencies

.gitea/workflows/cd.yml

@@ -4,6 +4,10 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+  # packages: write  # not yet supported by Gitea
+
 jobs:
   publish:
     name: Publish

.gitea/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   formatting:
     name: Formatting