Add explicit GITHUB_TOKEN permissions to workflow callers

[dduugg]

CodeQL actions/missing-workflow-permissions flagged the three
reusable-workflow caller jobs that had no effective permissions block
(ci.yml already declares contents: read). Each caller job now grants the
least privilege the called shared-config workflow actually needs, since a
caller's permissions become the ceiling for the whole called workflow.

• cd.yml -> contents: write. shared-config/cd.yml checks out with
  persisted credentials and runs discourse/publish-rubygems-action, whose
  rake release does a raw git push of the version tag, then runs
  gh release create. Anything less breaks the deploy. Its
  notify_on_failure job only posts to a Slack webhook and needs no scope.
• stale.yml -> issues: write + pull-requests: write. actions/stale
  comments on and closes both stale issues and stale PRs.
• triage.yml -> issues: write. shared-config/triage.yml runs
  gh issue edit --add-label triage and declares issues: write on its
  own job, so the caller must grant at least that.

Alerts resolved

• #4 actions/missing-workflow-permissions (medium) — .github/workflows/stale.yml:8
• #3 actions/missing-workflow-permissions (medium) — .github/workflows/cd.yml:11
• #1 actions/missing-workflow-permissions (medium) — .github/workflows/triage.yml:9

Verification

• Every job in every flagged workflow now has an effective permissions: block (cross-checked by parsing the YAML against the alert list).
• actionlint output is byte-identical to main — no new findings introduced.
• codeql.yml untouched.