ci(pact): scope record-deployment token at job level

Move 'permissions: contents: read' from workflow level to the record-deployment
job (GitHub Actions least-privilege, rule S8264), keeping this workflow uniform
with the astrolabe copy. Single-job workflow, but consistent and future-proof.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pact-record-deployment.yml

@@ -28,9 +28,6 @@ on:
     tags:
       - "v*"
 
-permissions:
-  contents: read
-
 # A re-tag (e.g. after a botched release) could push the same/overlapping tag
 # twice; don't cancel an in-flight recording — let it complete.
 concurrency:
@@ -46,6 +43,9 @@ jobs:
   record-deployment:
     name: Record production deployment
     runs-on: ubuntu-latest
+    # Least-privilege: scope the token at job level (GitHub Actions S8264).
+    permissions:
+      contents: read
     timeout-minutes: 5
     steps:
       - name: Join tailnet