ci(security): add a least-privilege permissions block to sync-check

[MANVENDRA-github]

Why

sync-check.yml declared no permissions:, so it inherited the repository's default GITHUB_TOKEN scope — read/write across contents, issues, and packages on older repo settings.

$ grep -L '^permissions:' .github/workflows/*.yml
.github/workflows/sync-check.yml

All three of its jobs (sync-determinism, frontmatter-lint, tests) only check out the repo and run npm. None writes a comment, a commit, or a release. release.yml already scopes itself to contents: write because it genuinely creates a Release — sync-check needs strictly less.

The part that stings

This repo ships:

• an infra-config-reviewer agent — "Reviews infrastructure-as-code and deploy config for misconfiguration — over-broad permissions, public exposure, root containers, unpinned images, plaintext secrets."
• a supply-chain-security skill.

A missing permissions: block on a CI workflow is the first thing either would report. It is also the first thing a reviewer greps for on a public repo.

Verification

$ python -c "import yaml; d=yaml.safe_load(open('.github/workflows/sync-check.yml')); print(d['permissions'], list(d['jobs']))"
{'contents': 'read'} ['sync-determinism', 'frontmatter-lint', 'tests']

$ npm run sync   # clean, no drift

This PR's own CI run is the proof the scope is sufficient — it executes under the new block.