Scoped GITEA_TOKEN to least privilege in Gitea Actions workflows.

.gitea/workflows/audit.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
     paths: [uv.lock]
 
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Dependencies

.gitea/workflows/cd.yml

@@ -4,6 +4,10 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+  # packages: write  # not yet supported by Gitea
+
 jobs:
   publish-package:
     name: Publish Package

.gitea/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [master]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   formatting:
     name: Formatting