fix: grant contents:write only to the release job

[MaximeGaudin]

Summary

• release.yml set a top-level permissions: contents: write, giving the write token to every job, including the five build matrix legs and the Homebrew tap job, none of which create releases.
• The workflow now declares contents: read at the top level and per-job grants where more is needed:
  • build: contents: read + actions: write (uploading build artifacts)
  • release: contents: write (creates/updates the GitHub release and uploads assets)
  • homebrew: contents: read + actions: read (downloads artifacts; pushes to the tap over SSH with its own deploy key, not the token)

Fixes #210

Test plan

• Workflow file parses as valid YAML. The release workflow is workflow_dispatch-only, so its permission mapping is not exercised by this PR's CI run; the grants follow the documented requirements of actions/upload-artifact, actions/download-artifact, and gh release usage.
• CI green on the PR