ci: grant the version workflow the permissions its image job needs

[Bccorb]

What broke

Every run of Version Changelog PR since 7ee36cf (2026-08-28) has ended in startup_failure at 0-1s. GitHub's validator rejects the workflow file:

.github/workflows/release.yml (Line: 121, Col: 3): Error calling workflow
'.../docker-publish.yml'. The workflow is requesting
'security-events: write, id-token: write', but is only allowed
'security-events: none, id-token: none'.

Why

A called workflow cannot be granted more than the calling job holds. docker-publish.yml declares four permissions at the workflow level, but the publish-image job was granting two:

Permission	Callee needs	Caller granted	Used by
contents: read	yes	yes	checkout
packages: write	yes	yes	ghcr push
id-token: write	yes	no	keyless cosign sign
security-events: write	yes	no	upload-sarif (trivy)

7ee36cf added the cosign signing and SARIF upload steps to docker-publish.yml without widening the caller's permissions block.

The consequence is larger than it looks. This is whole-run validation, not a job failure, so the version-changelog job never started either, even though publish-image is gated behind if: new_tag == 'true' and would rarely run at all. That is why no version PR has been opened in the last week. There are currently 34 pending changesets and the package is still at v0.7.4.

Worth noting: the actionlint step in ci.yml reports this clean. actionlint does not validate reusable workflow permission subsetting, so the workflow lint gave a false all-clear.

The change

Grants the publish-image job the two missing scopes so the caller's permissions match what docker-publish.yml declares.

Verification

• actionlint 1.7.12, exit 0
• npm run format:check clean
• pre-commit hook ran the full test suite, coverage and build
• the two permission sets now match exactly

One caveat worth stating plainly: actionlint cannot confirm this fix, since it never flagged the bug. The definitive check is GitHub's own parser on the next push to main. That push should also produce the backlogged version PR.

No changeset, since this is CI-only and not user-facing.