Move 'permissions: contents: read' from workflow level to the record-deployment job (GitHub Actions least-privilege, rule S8264), keeping this workflow uniform with the astrolabe copy. Single-job workflow, but consistent and future-proof. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>