fix(ci): replace permissions: read-all with the one scope these jobs need

.github/workflows/container-build.yml

@@ -29,7 +29,12 @@ on:
       - '.github/workflows/container-build.yml'
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: container-build-${{ github.ref }}

.github/workflows/e2e.yml

@@ -25,7 +25,12 @@ on:
     branches: [main, master]
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: e2e-${{ github.ref }}

.github/workflows/install-smoke.yml

@@ -22,7 +22,12 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: install-smoke-${{ github.ref }}

.github/workflows/zig.yml

@@ -23,7 +23,12 @@ on:
       - '.github/workflows/zig.yml'
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: zig-${{ github.ref }}