fix(ci): grant release-provenance build job write perms; pin pypa publish action

- build-artifacts needs contents: write for 'gh release upload'
- pin pypa/gh-action-pypi-publish to release/v1 SHA (Pinned-Dependencies)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: blove

.github/workflows/publish-middleware-python.yml

@@ -78,7 +78,7 @@ jobs:
 
       - name: Publish to PyPI (real release — OIDC trusted publishing)
         if: ${{ inputs.dry_run == false }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           packages-dir: packages/threadplane-middleware/dist
           attestations: true

.github/workflows/release-provenance.yml

@@ -11,7 +11,7 @@ jobs:
   build-artifacts:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write # gh release upload attaches tarballs to the release
     outputs:
       hashes: ${{ steps.hash.outputs.hashes }}
     env: