ci: declare explicit GITHUB_TOKEN permissions in workflows

[son-oz]

The product-security baseline rollout will set the repository default GITHUB_TOKEN permissions to read-only (with PR-approval by the token disabled). Workflows that rely on the current implicit write default would start failing at their next write operation. This PR makes each workflow's required permissions explicit so the downgrade is a no-op for this repo.

Workflow	Declared permissions
.github/workflows/changeset.yml	contents: read
.github/workflows/compile-cairo-alpha-project.yml	contents: read
.github/workflows/compile-cairo-project.yml	contents: read
.github/workflows/test.yml	contents: read

Scopes were inferred from the actions and commands each workflow uses; read-only workflows get contents: read. Draft on purpose — please review before marking ready.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}