Grant actions: read for the cache artifact download

Public-repo API leniency is what lets dawidd6/action-download-artifact
work without the scope today; the grant matches the documented
requirement and the comment publish.yml already carries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mmcky

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ jobs:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false"
     permissions:
       contents: read
+      actions: read         # dawidd6/action-download-artifact reads the cache.yml build artifact
       pull-requests: write
     steps:
       - uses: actions/checkout@v7