Fix CI: add contents:write permission for release uploads

Trigger on tag push instead of release event for simpler flow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: copyleftdev

.github/workflows/ci.yml

@@ -3,10 +3,12 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ['v*']
   pull_request:
     branches: [main]
-  release:
-    types: [published]
+
+permissions:
+  contents: write
 
 env:
   CARGO_TERM_COLOR: always
@@ -183,7 +185,7 @@ jobs:
           path: "*.deb"
 
       - name: Upload to release
-        if: github.event_name == 'release'
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
           files: "*.deb"