fix(ci): allow security check reporting

[m-szymanska]

Summary

• grant the Security Audit job read access to repository contents
• grant rustsec/audit-check permission to create its Check Run
• keep all other workflow jobs and token scopes unchanged

Root cause

The post-merge main run completed cargo audit with zero vulnerabilities, then failed while creating a Check Run because the repository defaults GITHUB_TOKEN to read-only.

Validation

• actionlint .github/workflows/ci.yml
• cargo fmt --check
• cargo +1.94 clippy --all-targets --all-features -- -D warnings
• cargo test (hermetic Semgrep test double)

[Copilot]

Pull request overview

This PR fixes the CI “Security Audit” job failing to publish results by granting only that job the minimum additional GITHUB_TOKEN permissions needed to create a GitHub Check Run, while keeping the rest of the workflow unchanged.

Changes:

• Add job-scoped permissions to the security job in .github/workflows/ci.yml.
• Grant contents: read (for checkout) and checks: write (to publish the audit check run) specifically for the Security Audit job.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.