fix(ci): add contents: read to the credo job

[joshprice]

The credo job declares its own permissions:

  credo:
    permissions:
      security-events: write

A job-level permissions: block replaces the workflow default rather than extending it, so the job runs with no contents permission. actions/checkout then fails:

fatal: repository 'https://github.com/<org>/<repo>/' not found
The process '/usr/bin/git' failed with exit code 128

Checkout of a public repository succeeds without contents, so this only affects private repos calling ash-ci.yml. mix credo --strict passes on team-alembic/ash_authentication (public) and fails at checkout on a private repo on the same workflow.

credo is the only ungated job that overrides permissions. deploy-docs also overrides, but is gated on publish-docs and a repository-owner check.