Part of #124. - `coverage.yml` grants `contents: write` at the workflow level. The badge deploy is already push-only (#151), so move the permission to that job and keep the rest read-only. - `test.yml` and `tox.yml` both run the 3.10–3.14 matrix. Keep one, or give them distinct roles.
Part of #124.
coverage.ymlgrantscontents: writeat the workflow level. The badge deploy is already push-only (ci: upload the coverage badge only on pushes to master #151), so move the permission to that job and keep the rest read-only.test.ymlandtox.ymlboth run the 3.10–3.14 matrix. Keep one, or give them distinct roles.