Allow release workflow qualification

[stefan-jansen]

Closes #64

Summary

• grant workflow-level contents: read so reusable qualification workflows can start
• retain narrower job-level write permissions only where publication requires them
• add a release pipeline contract test for the caller permission

Reproduction

• release run #34395191496 failed at startup because reusable workflows requested contents: read while the caller allowed contents: none
• no PyPI 0.1.6 files, tag, or GitHub release were created

Verification

• uv run pytest tests/test_contract/test_release_pipeline.py -q -n 0 (11 passed)
• actionlint .github/workflows/release.yml
• pre-commit run --all-files

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.