Add workflow-level permissions to GitHub Actions

[sbrunner]

Summary

Add top-level permissions: contents: read to pull-request-automation.yaml workflow to enforce least-privilege GitHub Actions permissions.

Context

• GitHub Actions workflows without explicit top-level permissions default to broad permissions
• The job already has permissions: pull-requests: write scoped correctly
• Adding contents: read at workflow level restricts the default token scope