fix(ci): grant the release caller the scopes the shared workflow declares

[unional]

Fixes the startup_failure on main from #844 (run 32346886564).

What broke

Pinning to @v2 did not just rename the action inputs — it moved to the workflow built for changesets/action v2, which pushes release commits and tags through the GitHub API rather than the git CLI (push-with-git-cli defaults to false). It therefore declares:

permissions:
  id-token: write
  contents: write
  pull-requests: write

release.yml granted id-token: write and contents: read at the top level. Declaring permissions: at all replaces the default set, so pull-requests was none. A called workflow cannot hold more than its caller, and the run fails at startup — before any job, which is why there are no logs and no annotations.

What this does

Declares the three scopes on the release job itself, leaving the top-level contents: read in place for verify.

docgen needs no change: pnpm-docs.yml declares no permissions block, so its job-level contents: write already covers it.

Verifying

The failure is only observable on a push to main, so this cannot be proven green from a PR — the next push after merge is the test.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 341dc03

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR