fix(ci): retain Actions and pull request read permissions

[peycheff-com]

Change

Retain contents: read, actions: read, and pull-requests: read in the reusable CI workflow so caller make check commands can read Actions evidence and pull request provenance with GITHUB_TOKEN.

The callee previously reduced the token to contents: read even when a caller requested the other reads. No callee job overrides this permission map. Update this repository's self-CI caller, the caller template, and the documented examples to grant the same reads explicitly; GitHub reusable workflows cannot raise caller permissions.

Verification

• make check passed: actionlint, shellcheck, and all 36 Python tests.
• git diff --check passed.
• No token write permissions added.
• Jev's automated rule check was unavailable because its daily budget was reached; local workspace and repository instructions were reviewed. This is not a Jev pass.

Rollout boundary

This PR changes source only. The existing v2 tag is unchanged. The D36 G0 GitOps caller will consume the exact merged commit after its caller grants these reads; the controller coordinates that pin and any later estate-wide v2 rollout. No other repositories, settings, grants, releases, or deployments are changed here.